+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: RFI / LFI vulnerable but show as PNG, how to exploit this ? (/showthread.php?tid=5986741)
RFI / LFI vulnerable but show as PNG, how to exploit this ? - shadowpig - Jul 5, 2019
Hi,
when i scan through the brute force attempts ip address
i found this website that have something like this
showImage.php?file=xyz
when i try to put in xyz like index.php, i get a gibberish page
it even works when i put a website link there
so i know this is definitely a RFI / LFI
i tried put some code in a PNG and load from it. but it doesn't run the code
however, if i'm able to decode the gibberish back to the php text, i will be able to read all its file (potentially etc/passwd ? )
so the question is, how do i turn a gibberish png format back to plain text ?
(it even have the PNG header)
(and i can get it in hex format by using burp)
The file ends with a valid PNG ending
00 00 00 00 49 45 4E 44 AE 42 60 82
The file also have a valid PNG starts
89 50 4E 47 0D 0A 1A 0A 00 00 00