1

There is a CTF Problem that it needs to see comments of a PHP file using some vulnerabilities of PHP; The Question is:
In the link bellow You must change lorem.php to read exact php comments of index.php file
http://web.ringzer0team.com:13371/index.php?page=lorem.php

I have tried index.php but it makes a infinite loop. And I now the permissions is wrong; e.g. /etc/passwd will show the passwd file and the flag in /etc/passwd is for another challenge

closed as off-topic by ThoriumBR, Steve Dodier-Lazaro, Xander, WhiteWinterWolf, Bob Brown Jun 4 '15 at 11:21

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – ThoriumBR, Steve Dodier-Lazaro, Xander, WhiteWinterWolf, Bob Brown
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Welcome to Information Security. Are you asking how to solve the CTF problem? Can you show what you have tried and narrow your question a little? The community is less responsive if it feels like you are asking for all the work to be done for you. – amccormack Jun 3 '15 at 4:51
  • 1
    I'd like to answer this question because this was a lot of fun to solve and I didn't know about this technique until you posted the question. But, I want to respect the game that ringzer0team has set up. The challenge provides an option to "purchase" a hint, if you want to go that route. I searched online and couldn't find a writeup, and I don't want to make the first public one. If you can make a question that isn't related to a specific CTF problem, it would be easier to answer. – amccormack Jun 3 '15 at 6:11
  • To see such samples we need a server that can load php sample. And I don't have one. – M.Fooladgar Jun 3 '15 at 7:31
1

If you encounter a local file inclusion (LFI) vulnerability there is a special technique that enables you to read files from the target system by making use of a PHP wrapper. This will not work in every case but you might want to give it a try.

You can read more about the PHP wrapper on the official php.net site:
http://php.net/manual/en/wrappers.php.php

This technique basically lets you use PHPs input and output streams as well as apply different filters to them. (http://php.net/manual/en/filters.php)

To read a resource you can use a payload in the form of:

php://filter/resource=/some/dir/secretfile.php

php://filter/resource=anothersecretfile.php

To apply a filter replace filtername with the name of the filter:

php://filter/filtername/resource=anothersecretfile.php

In some cases there will be errors depending on the specific implementation and surroundings of the LFI.
A good way do handle these can be to convert the output in a way that will not be interpreted by the target server.

On filter you might want to look at is the

convert.base64-encode

filter that converts the stream data to base64.

Not the answer you're looking for? Browse other questions tagged or ask your own question.