BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//hack-lu-2023//speaker//GDCJDQ
BEGIN:VTIMEZONE
TZID:Europe/Luxembourg
BEGIN:DAYLIGHT
DTSTART:20221018T000000
TZNAME:CEST
TZOFFSETFROM:+0200
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20221030T030000
RDATE:20231029T030000
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20230326T030000
RDATE:20240331T030000
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:PHP filter chains: How to use it - Rémi Matasse
DTSTART;TZID=Europe/Luxembourg:20231018T164500
DTEND;TZID=Europe/Luxembourg:20231018T171500
DTSTAMP:20260816T225026Z
UID:pretalx-hack-lu-2023-PL3P7Y@pretalx.com
DESCRIPTION:Local file inclusion methods in PHP evolved through time\, the
 re are 2 main objectives when exploiting them:\n - Getting a remote code e
 xecution by including files containing PHP via include() or require() func
 tions.\n - Leak local files such as PHP sources or configuration files via
  file_get_contents() or file() functions for example.\n \nIn the past\, th
 e following requirements had to be met to exploit a local file inclusion.\
 n To exploit a remote code execution you could inject information in log f
 iles and include them\, or control a variable in your PHP session to poiso
 n the session file. But in most cases\, you needed to be able to upload a 
 file on the system.\n \n To leak local files\, it was required to either f
 ully control the path pointing to the file to leak\, or to have a path tra
 versal to go up in the file tree. Most importantly\, it was mandatory for 
 the server to send you back its content in the response.\n \nIn both cases
 \, the affected functions support several wrappers\, the most iconic being
  file:// which is a prefix before a file path. Other wrappers such as php:
 //filter can be passed on these methods and for example it was well known 
 to allow leaking PHP sources by base64 encoding them (ex : php://filter/co
 nvert.base64-encode/resource=index.php). \n\n In a 2021 CTF write-up by lo
 knop \, this wrapper was actually proven to be much more useful. Indeed\, 
 it allows setting the encoding of contents passing through it\, and most i
 mportantly to chain an infinite number of encodings leading to the generat
 ion of arbitrary data at the start of a file. In this presentation\, the f
 ull process will be explained with examples allowing\, for instance\, to g
 enerate interesting prefixes to a file content\, such as '<?php system("id
 ")\; ?>'\, therefore removing the need to have a file upload when exploiti
 ng include() or require() functions to get remote code execution (if the f
 ull path is controlled).\n \nIn 2022\, hash_kitten showed that it was also
  possible to use PHP filters chain as an error-base oracle when used in ma
 ny built-in functions\, such as file_get_contents(). Its method chains enc
 odings that will make the content size of a file exponential\, triggering 
 a PHP memory_limit exhaustion. By using other filters\, the first characte
 r of the file content can also be determined. By using other encodings it 
 is also possible to rotate the chain order to retrieve characters that are
  located further away in the content.\n\n Using this error-based oracle\, 
 it is therefore possible to leak the entire file content without having PH
 P to serve it in a server response.
LOCATION:Salle Europe
URL:https://pretalx.com/hack-lu-2023/talk/PL3P7Y/
END:VEVENT
END:VCALENDAR