PHP Filter Injection: LFI2RCE Explained
There's a relatively new technique called LFI2RCE, which takes a local file include in PHP and uses it to get remote code execution without having to upload a file. This was first introduced by a CTF player named loknop, and picked up and spread by HackTricks, and then polished by Synative. It involves using PHP filters to convert junk over and over to put the desired text at the front. We'll dive into this and see how it works.
HackTricks LFI2RCE: https://book.hacktricks.xyz/pentestin...
loknop's CTF writeup: https://gist.github.com/loknop/b27422...
Detailed Synactive Writeup: https://www.synacktiv.com/publication...
php_filter_chain_generator: https://github.com/synacktiv/php_filt...
LFI examples:
Poison: https://0xdf.gitlab.io/2018/09/08/htb...
Pikaboo: https://0xdf.gitlab.io/2021/12/04/htb...
Trick: https://0xdf.gitlab.io/2022/10/29/htb...
CrimeStoppers: https://0xdf.gitlab.io/2018/06/03/htb...
UpDown: https://0xdf.gitlab.io/2023/01/21/htb...
RFI examples:
Sniper: https://0xdf.gitlab.io/2020/03/28/htb...
Proper: https://0xdf.gitlab.io/2021/08/21/htb...
☕ Buy Me A Coffee: https://www.buymeacoffee.com/0xdf
[00:00] Introduction
[01:06] Dummy PHP page
[03:32] Abusing to read files
[04:26] Abusing with webshell upload
[06:18] Remote file includes
[07:08] Overview of LFI2RCE
[08:00] php://temp
[09:34] Analysis of main function in script
[10:24] generate_filter_chain analysis
[10:58] Showing garbage generation in php terminal
[12:46] Adding characters to front of junk
[15:12] Letting code build script as base64
[16:10] Running script and testing output
[17:40] Overview of where this comes from
[18:47] Challenge of long URLs