Use the phpinfo information LFI temporary file

Do you still remember that the LFI proposed by a foreign ox contains temporary files?

The path and name of the temporary file are unknown, although the name of the temporary file can be similar <> *? Wildcard match (we temporarily call it a wildcard). If N people request together, many temporary files may be generated at the same time. Therefore, wildcards cannot be matched, in addition, the path for saving temporary files can only be guessed.

We know that when uploading data to any PHP file post request on the server, a temporary file will be generated. We did not know that the path and name of the temporary file can only be guessed, this time, foreign friends proposed to use phpinfo ().

When uploading data to any PHP file post request, you can find the path and name of the temporary file on the phpinfo page.

 

Refer:

Http://gynvael.coldwind.pl/download.php? F=PHP_LFI_rfc1867_temporary_files.pdf

Http://www.insomniasec.com/publications/LFI%20With%20PHPInfo%20Assistance.pdf

This paper contains a script written in python. At least I used it once and never succeeded once. Maybe it is the reason for indentation? Writing python code into pdf is not a good idea :(

So I wrote one by myself. If the website is fast, it takes several seconds. If the website is slow, it takes dozens of seconds to get shell.

 

Address: http://secer.org/pentest/lfi_tmp.py

If the space is down, save the image as rar and decompress it.

 

This script is only used for research and exchange by network security practitioners and network security enthusiasts. Do not use it for illegal purposes ...... By the way ......

# ----------------------- 2011.9.12 update -----------------------#

Sogili tested my script and reported an error, so I found the solution and gave it to him. By the way, I updated it here.

Sometimes the response of the website itself is very slow. Solution: gradually increase the padding length to drag the phpinfo page response.

In addition, some servers cannot be truncated at % 00. At this time, you can try to truncate them, or.

I have tested the local windows, and the German ping value is 500 + linux.