Feb 7, 2012 12:32 PM
(This post was last modified: Dec 10, 2012 12:52 PM by AntiPaste.)
Index
0x00 - Introduction
Greetings.
Basically what I'm about to demonstrate is a vulnerability in PHP versions up to and including 5.2.8 with Suhosin patch 0.9.6.3. The vulnerability allows for local file inclusion without the well-known, and patched, NULL-byte injection and affects at least the following functions: fopen, include(_once), require(_once), file_put_contents and file_get_contents.
This tutorial will not have a vast technical explanation on what's happening behind the scenes. If you're interested in that, you can read the full vulnerability write up at http://www.ush.it/2009/02/08/php-filesys...k-vectors/.
Let's begin.
0x01 - Summary
First off, a brief summary of the vulnerability.
PHP truncates paths used by filesystem functions, by default, into 4096 bytes. Thus by filling the buffer, we basically remove whatever is left at the end of the path sent as an argument to the function. This is what NULL-byte injection achieves as well, but differently. NULL-byte injection relies on C-based language's way of handling NULL-bytes as the end of a string, this vulnerability is a flaw in PHP itself, a design error.
The ideal way to fill the buffer is with "/." strings and this is the string this tutorial will be using.
0x02 - Exploitation
To start with, let's find ourselves an LFI vulnerable site.
http://www.becrux.com/index.php?page=projects just happens to be vulnerable to LFI in the page-parameter, as adding any character to the end of the URL [1] produces this error:
Hurray! Now, let's try to include an arbitrary file from the filesystem on with the notorious NULL-byte injection [2].
Alas, NULL-byte is escaped and we simply get another error instead of a successful exploitation:
Now's the time to crack out our filesystem path truncation attack.
We start off with an invalid directory, for example "a/".
Then we add our path traversal, pointing to the file that we want to include like this "../../style/style.css". The first "../" is for our invalid directory, don't forget that.
The path looks like this now: "a/../../style/style.css"
Here comes the exploit.
We add 2027 times the string "/." to the end of the path which will fill up the buffer and get rid of the ".php" at the end.
You end up with an URL like this: [3]
Success, we have included an arbitrary file on the server!
0x03 - Ending words
I hope this tutorial made any sense and / or was of use to anyone reading it. I'd appreciate feedback and corrections on it where applies.
Also, sorry for the bad example, however becrux.com refuses to include /etc/passwd due to a chroot.
- 0x00 - Introduction
- 0x01 - Summary
- 0x02 - Exploitation
- 0x03 - Ending words
0x00 - Introduction
Greetings.
Basically what I'm about to demonstrate is a vulnerability in PHP versions up to and including 5.2.8 with Suhosin patch 0.9.6.3. The vulnerability allows for local file inclusion without the well-known, and patched, NULL-byte injection and affects at least the following functions: fopen, include(_once), require(_once), file_put_contents and file_get_contents.
This tutorial will not have a vast technical explanation on what's happening behind the scenes. If you're interested in that, you can read the full vulnerability write up at http://www.ush.it/2009/02/08/php-filesys...k-vectors/.
Let's begin.
0x01 - Summary
First off, a brief summary of the vulnerability.
PHP truncates paths used by filesystem functions, by default, into 4096 bytes. Thus by filling the buffer, we basically remove whatever is left at the end of the path sent as an argument to the function. This is what NULL-byte injection achieves as well, but differently. NULL-byte injection relies on C-based language's way of handling NULL-bytes as the end of a string, this vulnerability is a flaw in PHP itself, a design error.
The ideal way to fill the buffer is with "/." strings and this is the string this tutorial will be using.
0x02 - Exploitation
To start with, let's find ourselves an LFI vulnerable site.
http://www.becrux.com/index.php?page=projects just happens to be vulnerable to LFI in the page-parameter, as adding any character to the end of the URL [1] produces this error:
Code
Warning: include(pages/projects!/index.php) [function.include]: failed to open stream: No such file or directory in /web/htdocs/www.becrux.com/home/index.php on line 111Hurray! Now, let's try to include an arbitrary file from the filesystem on with the notorious NULL-byte injection [2].
Alas, NULL-byte is escaped and we simply get another error instead of a successful exploitation:
Code
Warning: include(pages/../style/style.css\0/index.php) [function.include]: failed to open stream: No such file or directory in /web/htdocs/www.becrux.com/home/index.php on line 111Now's the time to crack out our filesystem path truncation attack.
We start off with an invalid directory, for example "a/".
Then we add our path traversal, pointing to the file that we want to include like this "../../style/style.css". The first "../" is for our invalid directory, don't forget that.
The path looks like this now: "a/../../style/style.css"
Here comes the exploit.
We add 2027 times the string "/." to the end of the path which will fill up the buffer and get rid of the ".php" at the end.
You end up with an URL like this: [3]
Success, we have included an arbitrary file on the server!
0x03 - Ending words
I hope this tutorial made any sense and / or was of use to anyone reading it. I'd appreciate feedback and corrections on it where applies.
Also, sorry for the bad example, however becrux.com refuses to include /etc/passwd due to a chroot.
