diff --git a/SUMMARY.md b/SUMMARY.md index 24f2d3a9..e6ab082a 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -498,7 +498,7 @@ * [LFI2RCE via Segmentation Fault](pentesting-web/file-inclusion/lfi2rce-via-segmentation-fault.md) * [LFI2RCE via phpinfo()](pentesting-web/file-inclusion/lfi2rce-via-phpinfo.md) * [LFI2RCE Via temp file uploads](pentesting-web/file-inclusion/lfi2rce-via-temp-file-uploads.md) - * [LFI2RCE via Eternal Waiting](pentesting-web/file-inclusion/lfi2rce-via-eternal-waiting.md) + * [LFI2RCE via Eternal waiting](pentesting-web/file-inclusion/lfi2rce-via-eternal-waiting.md) * [LFI2RCE Via compress.zlib + PHP\_STREAM\_PREFER\_STUDIO + Path Disclosure](pentesting-web/file-inclusion/lfi2rce-via-compress.zlib-+-php\_stream\_prefer\_studio-+-path-disclosure.md) * [File Upload](pentesting-web/file-upload/README.md) * [PDF Upload - XXE and CORS bypass](pentesting-web/file-upload/pdf-upload-xxe-and-cors-bypass.md) diff --git a/pentesting-web/file-inclusion/lfi2rce-via-eternal-waiting.md b/pentesting-web/file-inclusion/lfi2rce-via-eternal-waiting.md index 7945f7b5..54542e4b 100644 --- a/pentesting-web/file-inclusion/lfi2rce-via-eternal-waiting.md +++ b/pentesting-web/file-inclusion/lfi2rce-via-eternal-waiting.md @@ -1,4 +1,4 @@ -# LFI2RCE via Eternal Waiting +# LFI2RCE via Eternal waiting
@@ -14,7 +14,7 @@ ## Basic Information -By default when a file is uploaded to PHP (even if it isn't expecting it), it will generate a temporary file in `/tmp` with a name such as **`php[a-zA-Z0-9]{6}`**, although I have been some docker images where the generated files don't contain digits. +By default when a file is uploaded to PHP (even if it isn't expecting it), it will generate a temporary file in `/tmp` with a name such as **`php[a-zA-Z0-9]{6}`**, although I have seen some docker images where the generated files don't contain digits. In a local file inclusion, **if you manage to include that uploaded file, you will get RCE**. @@ -34,7 +34,7 @@ This technique is **very similar to the last one but without needed to find a ze ### Eternal wait technique -In this technique **we only need to control a relative path** (no need for PHP protocols). If we manage to upload files and make the **LFI never end**, we will have "enough time" to **brute-force uploaded files** and **find** any of the ones uploaded. +In this technique **we only need to control a relative path**. If we manage to upload files and make the **LFI never end**, we will have "enough time" to **brute-force uploaded files** and **find** any of the ones uploaded. **Pros of this technique**: @@ -49,11 +49,11 @@ The **main problems** of this technique are: * The **insane** amount of potential file names: **56800235584** * If the server **isn't using digits** the total potential amount is: **19770609664** * By default **only 20 files** can be uploaded in a **single request**. -* The **max number of workers** of the used server. - * This limit with the previous one can make this attack last too much -* **Timeout for a PHP request**. Ideally this should be eternal, if not, this will also be a pain +* The **max number of parallel workers** of the used server. + * This limit with the previous ones can make this attack last too much +* **Timeout for a PHP request**. Ideally this should be eternal or should kill the PHP process without deleting the temp uploaded files, if not, this will also be a pain -So, how can you **make a PHP include never end**? Just by including the file **`/sys/kernel/security/apparmor/revision`** (**not available in Docker containers** unfortunatelly...). +So, how can you **make a PHP include never end**? Just by including the file **`/sys/kernel/security/apparmor/revision`** (**not available in Docker containers** unfortunately...). Try it just calling: @@ -77,19 +77,19 @@ Let's do some maths: * (without digits) 19770609664 / 2980 / 10 / 3600 \~= 185h (50% chance in 93h) {% hint style="warning" %} -Note that in the previous example we are **completing DoSing other clients**! +Note that in the previous example we are **completely DoSing other clients**! {% endhint %} If the Apache server is improved and we could abuse **4000 connections** (half way to the max number). We could create `3999*20 = 79980` **files** and the **number** would be **reduced** to around **19.7h** or **6.9h** (10h, 3.5h 50% chance). ## PHP-FMP -If instead of using the regular php mod for apache to run PHP scripts the web page is using **PHP-FMP** (this improves the response of the web page, so it's "normal" to find it), there is something else that can be done to improve the technique. +If instead of using the regular php mod for apache to run PHP scripts the **web page is using** **PHP-FMP** (this improves the efficiency of the web page, so it's common to find it), there is something else that can be done to improve the technique. -PHP-FMP allow to **configure** the **parameter** **`request_terminate_timeout`** in `/etc/php//fpm/pool.d/www.conf`.\ -This parameter indicates **when** should a **request to PHP terminate** (infinite by default, but 30s if the param is uncommented). When a request is being processed by PHP the indicated number of seconds, it's **killed**. This means, that if the request was uploading temporary files, because the **php processing was stopped**, those **files aren't going to be deleted**. Therefore, if you can make a request last that time, you can **generate thousands of temporary files** that won't be deleted, which will **speed up the process of finding them** and reduces the probability of a DoS to the platform by consuming all connections. +PHP-FMP allow to **configure** the **parameter** **`request_terminate_timeout`** in **`/etc/php//fpm/pool.d/www.conf`**.\ +This parameter indicates the maximum amount of seconds **when** **request to PHP must terminate** (infinite by default, but **30s if the param is uncommented**). When a request is being processed by PHP the indicated number of seconds, it's **killed**. This means, that if the request was uploading temporary files, because the **php processing was stopped**, those **files aren't going to be deleted**. Therefore, if you can make a request last that time, you can **generate thousands of temporary files** that won't be deleted, which will **speed up the process of finding them** and reduces the probability of a DoS to the platform by consuming all connections. -So, to **avoid DoS** lets suppose that an **attacker will be using only 100 connections** at them same time and php max processing time by **php-fmp** is 30s. Therefore, the number of temp files that can be generated by second is `100*20/30 = 66.67`. +So, to **avoid DoS** lets suppose that an **attacker will be using only 100 connections** at the same time and php max processing time by **php-fmp** (`request_terminate_timeout`**)** is **30s**. Therefore, the number of **temp files** that can be generated **by second** is `100*20/30 = 66.67`. Then, to generate **10000 files** an attacker would need: **`10000/66.67 = 150s`** (to generate **100000 files** the time would be **25min**).