+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [TuT] Exploiting LFI with PHP://INPUT filter [TuT] (/showthread.php?tid=2098978)
Pages: Pages
1
2
[TuT] Exploiting LFI with PHP://INPUT filter [TuT] - Hooded Robin - Jan 10, 2012
I have alreday prepared a rather in depth written tutorial on this fairly undocumented attack vector and how this method can be used to attack Windows machines. If you are interested in the full detials on how to perform manually you can check it out on my blog, available here: http://kaoticcreations.blogspot.com/2012/01/burp-suite-part-vi-more-fun-exploiting.html
That being said, I wanted to find an easier way and I found that this method is incredibly easy to do with the assistance of CURL. Here is a quick video I made which more or less mirrors the written tutorial just shortened up with CURL. I also decided to show it in action against a Unix target since the written tutorial covers how to do this against a Windwos machine.
I hope you enjoy the show:
Please let me know what you think and if you have any questions on anything please dont hesitate to ask.
Greetz to Zer0Lulz crew!
Enjoy 🤝
* - Hivem1nd - Jan 10, 2012
Thank you! I've been trying to figure out on my own how to apply LFI exploits to Windows servers so this should be really helpful.
* - Hooded Robin - Jan 10, 2012
The written tutorial I did should give your more than enough to tackle Windows LFI, and the log file method which I previously covered can also be used against Windows, but this is the best and easiest method I have found yet for exploiting Winblows :)
* - Zher0 - Jan 10, 2012
Thank you very helpful, and I like the first song ;)
* - th3.g4m3_0v3r - Jan 10, 2012
Bro please Upload Hd Version Of This Video
To short...
* - Zher0 - Jan 10, 2012
(Jan 10, 2012 09:55 PM)th3.g4m3_0v3r Wrote: Bro please Upload Hd Version Of This Video
To short...
You can choose 1080p... how much more HD can you get on youtube 0.0
* - PličkaMaterna - Jan 11, 2012
I am not sure if HF people deserve to know about wrappers.
They will just copy pasta from your tut...
* - Hooded Robin - Jan 11, 2012
Hehe, I would imagine this is still over the heads with a lot of folks around here, but I wanted to complete my LFI series so here it is. The written tut goes into much more detail on why everything works and is written for a novice to be able to understand. I had not seen this documented anywhere else, so curious if others were already aware of this method or not. Anyone else use this before? Anyone having any problems implementing my methods or approach? Looking for real feedback people...
* - -DownFall - Jan 11, 2012
Finally got around to checking it out, great thread once again. Your threads don't get much feedback, but the ones who actually take the time to watch them appreciate it. Keep up the good work, you're a fucking genius lol.
PS: Thanks for the PM!
* - LulzSecFTW - Jan 11, 2012
Thanks, great tut, I knew about the wrappers... but I never for one second thought about using them to hack via LFI. ^_^
I do have one problem though:
PHP Code
<?php
Warning: include(php://input) [function.include]: failed to open stream: operation failed in /xxx/test.php on line 2
I get it to work with fopen / file_get_contents just fine though :D thanks again,
* - Hooded Robin - Jan 11, 2012
I dont think many people do, hence all the LFI tuts by me lately. I dont think I will make any more since i have kind of beat LFI to death but you can also use data:// wrapper as well to execute commands. Glad you enjoyed and found it informative!
Please keep the comments coming...
* - Prominent - Jan 11, 2012
Impressed, detailed, you know your shit very well. Well done.
Spoiler (Click to View)
* - Hooded Robin - Jan 11, 2012
Thanks Prominent, much apprecaited from you!
PS - I love deadmau5 and your sig!
* - LulzSecFTW - Jan 11, 2012
@Hooded Robin, data wrapper works perfectly! I noticed php://input doesn't get blocked by security but data:// sometimes does.
Even still... does anyone know why I keep getting a php error when trying to POSTDATA a php code using php://input in a LFI (which uses includes() ) ?
^ using wrappers unlocks a load more websites to be hacked. :D
* - Hooded Robin - Jan 11, 2012
It all depends on what streams they allow, but people commonly forget to secure the php:// and data:// wrappers which are just as viable as http:// if abused under the right conditions :)
What error are you getting? It might be disabled... Maybe hit me up via PM and share link if you dont mind and we can try to see if we can find a method to make it work...