PHP Filter Injection: LFI2RCE Explained

There's a relatively new technique called LFI2RCE, which takes a local file include in PHP and uses it to get remote code execution without having to upload a file. This was first introduced by a CTF player named loknop, and picked up and spread by HackTricks, and then polished by Synative. It involves using PHP filters to convert junk over and over to put the desired text at the front. We'll dive into this and see how it works.

HackTricks LFI2RCE: https://book.hacktricks.xyz/pentesting-web/file-inclusion/lfi2rce-via-php-filters
loknop's CTF writeup: https://gist.github.com/loknop/b27422d355ea1fd0d90d6dbc1e278d4d
Detailed Synactive Writeup: https://www.synacktiv.com/publications/php-filters-chain-what-is-it-and-how-to-use-it.html
php_filter_chain_generator: https://github.com/synacktiv/php_filter_chain_generator

LFI examples:
- Poison: https://0xdf.gitlab.io/2018/09/08/htb-poison.html#web-shell-via-log-poisoning
- Pikaboo: https://0xdf.gitlab.io/2021/12/04/htb-pikaboo.html#log-poisoning
- Trick: https://0xdf.gitlab.io/2022/10/29/htb-trick.html#shell-via-mail-include
- CrimeStoppers: https://0xdf.gitlab.io/2018/06/03/htb-crimestoppers.html#webshell
- UpDown: https://0xdf.gitlab.io/2023/01/21/htb-updown.html#php-execution
RFI examples:
- Sniper: https://0xdf.gitlab.io/2020/03/28/htb-sniper.html#path-2---rfi
- Proper: https://0xdf.gitlab.io/2021/08/21/htb-proper.html#rfi

☕ Buy Me A Coffee: https://www.buymeacoffee.com/0xdf

[00:00] Introduction
[01:06] Dummy PHP page
[03:32] Abusing to read files
[04:26] Abusing with webshell upload
[06:18] Remote file includes
[07:08] Overview of LFI2RCE
[08:00] php://temp
[09:34] Analysis of main function in script
[10:24] generate_filter_chain analysis
[10:58] Showing garbage generation in php terminal
[12:46] Adding characters to front of junk
[15:12] Letting code build script as base64
[16:10] Running script and testing output
[17:40] Overview of where this comes from
[18:47] Challenge of long URLs