webProhard

Never let go

hackerlab

Task: Achieve RCE on a PHP application with LFI via include() with .php extension appended. Solution: Use php://filter/convert.base64-encode to read source code and leak credentials, then use php_filter_chain_generator to craft an iconv filter chain that injects arbitrary PHP code through the LFI without file upload.

$ ls tags/ techniques/
rcelfisource_code_disclosurephp_filterphp_filter_chain
lfi_to_rcephp_filter_wrapperphp_filter_chain_generatorcredential_leak
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups