Bypassing PHP code filter. - Printable Version

Bypassing PHP code filter. - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Bypassing PHP code filter. (/showthread.php?tid=2936090)

Bypassing PHP code filter. - ๖ۣۜMค੮עƿค੮੮ע - Oct 12, 2012

Im trying to execute a shell on a vBulletin site via a vBa CMPS html module as the account I am using does not have permissions to the plugin system. My problem being that any php tags are phrased and commented out like this:

Code 
[b]<!--[/b]?php code here ?-->

Just wondering if there is an easy way to bypass this filter or any other way I could execute the php.

Thanks in advance,
-Matt

* - Psyman - Oct 12, 2012

Try canceling it out by re-ordering this "--".

Will probably cancel out the comment but not sure if it'll work out for you.

* - ๖ۣۜMค੮עƿค੮੮ע - Oct 12, 2012

(Oct 12, 2012 03:53 AM)Psyman Wrote: Try canceling it out by re-ordering this "--".

Will probably cancel out the comment but not sure if it'll work out for you.

Not 100% sure what you mean, the "--" is inserted automatically by the phrasing script.

For example:

Code 
Input:

<?php code here ?>

Output:

<--?php code here ?-->

* - Th3PonyWizard - Oct 12, 2012

Code 
%3C%3Fphp

//code goes here

%3F%3E

Also try ASP tags.

Code 
<%

%>

* - Psyman - Oct 12, 2012

(Oct 12, 2012 04:29 AM)๖ۣۜMค੮עƿค੮੮ע Wrote: Not 100% sure what you mean, the "--" is inserted automatically by the phrasing script.

For example:

Code
Input: <?php code here ?> Output: <--?php code here ?-->

You're clearly clueless with basic HTML, -- cancels out HTML comments.

* - ๖ۣۜMค੮עƿค੮੮ע - Oct 12, 2012

(Oct 12, 2012 04:38 AM)Th3PonyWizard Wrote:
Code
%3C%3Fphp //code goes here %3F%3E
Also try ASP tags.

Code
<% %>

Both cause the code to be shown as plaintext.
[Image: bHgsD.png]

(Oct 12, 2012 04:39 AM)Psyman Wrote: You're clearly clueless with basic HTML, -- cancels out HTML comments.

I do not know much at all about HTML, if I add -- to close the comment made I am still going to be unable to run the script, right?

* - Psyman - Oct 12, 2012

(Oct 12, 2012 05:07 AM)๖ۣۜMค੮עƿค੮੮ע Wrote: Both cause the code to be shown as plaintext.

I do not know much at all about HTML, if I add -- to close the comment made I am still going to be unable to run the script, right?

As long as it's not within the PHP tags, hopefully.

* - Phizo - Oct 12, 2012

(Oct 12, 2012 04:38 AM)Th3PonyWizard Wrote:
Code
%3C%3Fphp //code goes here %3F%3E
Also try ASP tags.

Code
<% %>

I don't see how URL encoding is going to help since it won't ever get decoded.

As far as I can see there's no way around it, it blocks all variations of PHP opening tags since all variations require at least <?.
Not even a short echo tag would work (<?=) since, assuming they're matching just <?, it will just be filtered and replaced with HTML comment tags.
If it were simple to bypass then it most likely would've been discussed somewhere already.

* - Ϲasp3r - Oct 12, 2012

(Oct 12, 2012 05:10 PM)Phizo Wrote: I don't see how URL encoding is going to help since it won't ever get decoded.

As far as I can see there's no way around it, it blocks all variations of PHP opening tags since all variations require at least <?.
Not even a short echo tag would work (<?=) since, assuming they're matching just <?, it will just be filtered and replaced with HTML comment tags.
If it were simple to bypass then it most likely would've been discussed somewhere already.

OffTopic: have not seen you on in a bit :D

OnTopic: Phizo knows what he's doing. Trust this guy. If he says it wont help, it wont help.

* - dofawa - Oct 13, 2012

Thank you alot I Mp as soon as I bit!