LFI2RCE via PHP_SESSION_UPLOAD_PROGRESS
Last updated
Last updated
Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze & fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Ikiwa umepata Local File Inclusion hata kama huna session na session.auto_start iko Off. Ikiwa session.upload_progress.enabled iko On na unatoa PHP_SESSION_UPLOAD_PROGRESS katika data ya multipart POST, PHP itafanya iwezeshe session kwa ajili yako.
Note that with PHP_SESSION_UPLOAD_PROGRESS you can control data inside the session, so if you includes your session file you can include a part you control (a php shellcode for example).
Ingawa mafunzo mengi kwenye Mtandao yanapendekeza kuweka session.upload_progress.cleanup kuwa Off kwa ajili ya kusahihisha makosa. Kuweka session.upload_progress.cleanup kwa default katika PHP bado ni On. Inamaanisha kwamba maendeleo yako ya upakiaji katika kikao yatakuwa safishwa haraka iwezekanavyo. Hivyo hii itakuwa Race Condition.
Katika CTF ya asili ambapo mbinu hii inazungumziwa, haikutosha kutumia Race Condition lakini yaliyomo yaliyopakiwa yalihitaji kuanza pia na mfuatano @<?php.
Kwa sababu ya mipangilio ya default ya session.upload_progress.prefix, faili yetu ya SESSION itaanza na kiambishi kisichofurahisha upload_progress_ Kama: upload_progress_controlledcontentbyattacker
Njia ya kuondoa kiambishi cha mwanzo ilikuwa base64encode payload mara 3 na kisha kuifungua kupitia vichujio convert.base64-decode, hii ni kwa sababu wakati wa base64 decoding PHP itafuta wahusika wa ajabu, hivyo baada ya mara 3 tu payload iliyotumwa na mshambuliaji itabaki (na kisha mshambuliaji anaweza kudhibiti sehemu ya mwanzo).
Taarifa zaidi katika andiko la asili https://blog.orange.tw/2018/10/ na exploit ya mwisho https://github.com/orangetw/My-CTF-Web-Challenges/blob/master/hitcon-ctf-2018/one-line-php-challenge/exp_for_php.py Andiko lingine katika https://spyclub.tech/2018/12/21/one-line-and-return-of-one-line-php-writeup/
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
