PHP Wrappers
PHP offers a variety of protocol wrappers to enhance the language’s capabilities.
For example, PHP wrappers can b used to represent and access
local or remote filesystems.
We can use these wrappers to bypass filters or obtain code execution
via File Inclusion vulnerabilities in PHP web applications.
While we’ll only examine the php://filter and data:// wrappers,
many are available.
We can use the php://filter wrapper to display the contents of files
either with or without encodings like ROT13 or Base64.
In the previous section, we covered using LFI to include the contents of files.
Using php://filter, we can also display the contents of executable files such as
.php, rather than executing them.
This allows us to review PHP files for sensitive information and analyze
the web application’s logic.
Let’s demonstrate this by revisiting the “Mountain Desserts” web application.
First we’ll provide the admin.php file as a value for the “page” parameter.
The output shows the title and maintenance text we already encountered
while reviewing the web application earlier.
We also notice that the tag is not closed at the end of the HTML code.
We can assume that something is missing.
PHP code will be executed server side and, as such, is not shown.
When we compare this output with previous inclusions
or review the source code in the browser,
we can conclude that the rest of the index.php page’s content is missing.
Next, let’s include the file,
using php://filter to better understand this situation.
We will not use any encoding on our first attempt.
The PHP wrapper uses resource as the required parameter
to specify the file stream for filtering, which is the filename in our case.
We can also specify absolute or relative paths in this parameter.
The output shows the same result as our last request.
This makes sense since the PHP code is included
and executed via the LFI vulnerability.
Let’s now encode the output with base64 by adding convert.base64-encode.
This converts the specified resource to a base64 string.
The response shows that we included base64 encoded data,
while the rest of the page loaded correctly.
We can now use the base64 program with the -d flag to decode
the encoded data in the terminal.
The decoded data contains MySQL connection information,
including a username and password.
We can use these credentials to connect to the database
or try the password for user accounts via SSH.
While the php://filter wrapper can be used to include the contents of a file,
we can use the data:// wrapper to achieve code execution.
This wrapper is used to embed data elements as plaintext
or base64-encoded data in the running web application’s code.
This offers an alternative method when we cannot poison a local file with PHP code.
Let’s demonstrate how to use the data:// wrapper with the
“Mountain Desserts” web application.
To use the wrapper, we’ll add data:// followed by the
data type and content.
In our first example, we will try to embed a small URL-encoded PHP snippet
into the web application’s code.
We can use the same PHP snippet as previously with the ls command.
Our embedded data was successfully executed
via the File Inclusion vulnerability and data:// wrapper.
When web application firewalls or other security mechanisms are in place,
they may filter strings like “system” or other PHP code elements.
In such a scenario, we can try to use the data:// wrapper with base64-encoded data.
We’ll first encode the PHP snippet into base64,
then use curl to embed and execute it via the data:// wrapper.
We successfully achieved code execution with the base64-encoded PHP snippet.
This is a handy technique that may help us bypass basic filters.
However, we need to be aware that the data:// wrapper will not work in a default
PHP installation.
To exploit it, the allow_url_include setting
needs to be enabled.