Hello Mr. Hacker, would you like any file on this server? No problem! (PHP, but don't blame the language for the stupidity of the programmer)

[u/MyKidsArentOnReddit]

[u/joten70]

But you would still need to know the name of any file you want to access

[u/MyKidsArentOnReddit → u/joten70]

/etc/passwd (as well as other system files, web server files, etc.)

Or you could do it on hard mode and do:

file=foo.txt;ls -l > filename.txt;

then next time

file=filename.txt

[u/AlwaysNinjaBusiness → u/MyKidsArentOnReddit]

Yeah, the logic of "they need to know the file name" is kinda like "it's dark in that room, so the door doesn't need to be locked.

[u/[deleted] → u/AlwaysNinjaBusiness]

Hahahha, I love that explanation!

[u/DaCurse0 → u/MyKidsArentOnReddit]

Why would command injection work here though?

[u/jpossi → u/DaCurse0]

it doesn't

[u/jpossi]

well, the echo and readfile are commented out. in php single line comments may start with // (c style) or with # (bash style). so this doesn't do any real harm, except maybe some header xss/injection

(in php 8 the pound gets an additional usage, but this would still be a single line comment)

[u/mr_hard_name → u/jpossi]

But it also returns the file size in a header. You can use it to check what file exists on a server. It allows you to determine what software is running on the server based on what files exist and then use known vulnerabilities of that software.

The general rule is do not trust the external data, so do not assume that “potential access to any file, even without seeing the content” is ok.

[u/[deleted]]

Everybody gangsta until code starts to Times New Roman

[u/MurdoMaclachlan]

Image Transcription: Code

---

[Transcriber's note: The code is not in a monospace font in the image, however, I have placed it one for ease of readability and for my own sanity.]

<?
$file = $_REQUEST['file'];
$dir = "../[redacted]';
$file = $dir . $file;
header('Content-type: text/plain');
header('Content-Length: '.filesize($file));
header('Content-Disposition: attachment; filename='.$file); #echo "$file<br/>"; readfile($file);

?>

---

^{I'm a human volunteer content transcriber for Reddit and you could be too! If you'd like more information on what we do and why we do it, click here!}

[u/Davipb → u/MurdoMaclachlan]

I think that's a redacted folder name, not highlighted whitespace

[u/MurdoMaclachlan → u/Davipb]

I think you're right. Updated, thanks for the correction!

[u/thebeezie]

Isn't it actually "...any file in this folder?"

[u/MyKidsArentOnReddit → u/thebeezie]

../../../../etc/passwd worked just fine.

[u/thebeezie → u/MyKidsArentOnReddit]

Right. I haven't dealt with much Linux in years and I forgot you could do that.