PHP Wrappers for RCE

Remote Code Execution via PHP Wrappers

PHP wrappers enable attackers to achieve Remote Code Execution (RCE) through LFI vulnerabilities when include functions have execute privileges. This section covers the most effective wrapper-based RCE techniques.

Prerequisites for PHP Wrapper RCE

Required Conditions:

  • LFI vulnerability in PHP application

  • Include function with execute privileges

  • Specific PHP configuration settings (varies by wrapper)

Vulnerable Functions Supporting RCE:

Function
Read Content
Execute
Remote URL

include() / include_once()

βœ…

βœ…

βœ…

require() / require_once()

βœ…

βœ…

❌


Method 1: Data Wrapper RCE

The data:// wrapper allows embedding PHP code directly in the URL, providing an immediate RCE vector.

Basic Data Wrapper Syntax

Configuration Requirements:

Basic Syntax:

Data Wrapper Examples

Simple Command Execution:

Base64 Encoded PHP:

HTB Academy Data Wrapper Lab

Target Configuration:

  • Lab Environment: HTB Academy platform

  • Objective: Achieve RCE using data wrapper

Step-by-Step Solution:


Method 2: Input Wrapper RCE

The php://input wrapper reads raw POST data, allowing PHP code execution through POST requests.

Input Wrapper Configuration

Configuration Requirements:

Basic Usage:

Input Wrapper Examples

Basic POST RCE:

Advanced Input Wrapper Usage:

HTB Academy Input Wrapper Lab

Complete Exploitation Process:


Method 3: Expect Wrapper RCE

The expect:// wrapper provides direct command execution without requiring PHP code.

Expect Wrapper Configuration

Configuration Requirements:

Basic Usage:

Expect Wrapper Examples

Basic Command Execution:

Advanced Expect Usage:

HTB Academy Expect Wrapper Lab

Testing Process:


PHP Configuration Verification

Checking allow_url_include

Method 1: phpinfo() via Data Wrapper

Method 2: Direct Configuration Check

Method 3: ini_get() Function

Testing Wrapper Support

Comprehensive Wrapper Testing:


Wrapper RCE Troubleshooting

Problem: Data wrapper not working

Problem: Input wrapper issues

Problem: Expect wrapper not available

Problem: PHP code not executing


Tools and Resources

RCE Testing Scripts

Automated Wrapper Testing:

Payload Generation Tools

Base64 PHP Payload Generator:

URL Encoding Helper:

Common PHP RCE Payloads

Web Shell Payloads:

Base64 Encoded Payloads:


This guide covers PHP wrapper techniques for achieving RCE through LFI vulnerabilities, based on HTB Academy's File Inclusion module. These methods are essential for escalating LFI to full system compromise.

Last updated