(Jul 7, 2017 01:40 AM)Zixem Wrote:  Are you sure you implemented the Path Truncation right? the total input for the include() function is supposed to be 4096 bytes.
It means /src/+(YOUR BUFFER) = 4096 bytes or more.

plus, why did you showed only the file_exist() warning?
did you get any actual file inclusion errors?(they might be turned off, but i'm curious about what's going on over there)

(Jul 7, 2017 11:29 AM)ghana Wrote:  What it seems to be doing is checking if the file exists through file_exists() then passing input to a function that reads that data (probably include(), require(), readfile(), etc. most likely include() tho) the input is then appended '.php' and in a specific directory. I am able to include different PHP files by doing ..

VulnerablePage.php?file=../../testpage

Which will include testpage.php because '.php' is already appended I am looking for a way to escape this to retrieve /etc/passwd

I am pretty sure the code is setup kinda like this ~

PHP Code


<?php
$file = $_GET['file'];
if (file_exists($file)) {
include('/src/' . $file . '.php');
} else {
echo '404';
}
?>

or this ~

PHP Code


<?php
$file = $_GET['file'] . '.php';
if (file_exists($file)) {
include('/src/' . $file);
} else {
echo '404';
}
?>

either way its appending .php to the inputted file

I will go ahead and test and make sure the path truncation is correct

(Jul 7, 2017 01:22 PM)Zixem Wrote:  hm, like i assumed.
i'm pretty sure that the Path Truncation is supposed to evade the file_exists() function too. because the truncation is happening on any buffer that represents a filename, and not a specific argument in a specific function.
another point to mention - make sure that your input characters matches the server's encoding\character representation in bytes(unicode\utf8\whatever the fuck it is) so you can fill the buffer with the right amount of bytes.
lmk what's going on 👹

(Jul 9, 2017 09:27 AM)c00perzz Wrote:  Em, why do you assume what the code looks like and don't you just run VulnerablePage.php?file=VulnerablePage to see the actual source code :S