Difference between phpp, php, and phP?

Question

I came across a ctf challenge where php file upload was restricted but phpp and phP were not. What other formats can php be uploaded in and what is the difference?

Answer 1

Like a usual CTF challenge, the idea is that someone set something up but there is a vulnerability in it. Your goal is to get the flag, and since you can upload a file, you probably have to get your code to run on the server (so it can list files in the directory and read the flag file).

If you can upload <?php echo `ls`; in example.php on the server, the server will probably execute the file when you open the URL. Apparently, someone tried to prevent users from uploading files with the .php extension. But as you've noticed, a file ending in .phP is fine. The programmer probably did something like this:

if (substr_count($filename, ".php") != 0){ reject upload; }

So you can't upload .php files... but the web server doesn't care if it's called .php or .PHP or .phP: its configuration just says that anything ending in .php (case-insensitive) should be executed as if it were PHP code. The extension is just part of the filename, so the contents are still the same, only the name is different. If you feel like it, you can put PHP code in a file called example.aayush and configure Apache or Nginx to execute .aayush files as PHP code. And since they are typically case-insensitive, you can then also run .Aayush files the same way.

Hope this helps in solving the challenge!

Or, if you want to know how to fix this vulnerability, see questions tagged: file-upload.

Answer 2

Well, I have also noticed this behavior. As @schroeder mentioned in the comments at first I also thought it had to do with the upload function but then I decided to try out some tests. So for example if we have a php file called test.php and contains the following code:

<?php echo shell_exec('whoami'); ?>

If we try to execute it with php test.php (assuming php is installed) then it will be successfully executed. Now the strange part indeed is that if we change the extension it still works. Here's a POC that automatically changes the extension and tries to execute the file:

#!/bin/bash

# file with some possible extensions...
declare -a extensions=("test.phP" "test.PHp" "test.asdfphp" "test" "test.txt")

tmp='test.php'
for ext in "${extensions[@]}";do
    echo -e "Renaming file to $ext and try to execute it..."
    mv $tmp $ext; php $ext
    tmp=$ext
done

So all those file-extensions are executed properly. The results of the above script are:

Renaming file to test.phP and try to execute it...
username
Renaming file to test.PHp and try to execute it...
username
Renaming file to test.asdfphp and try to execute it...
username
Renaming file to test and try to execute it...
username
Renaming file to test.txt and try to execute it...
username

Now even if we remove the php keyword from the <?php tag in test.php file, or even remove the last closing tag ?> the script is still valid php code (as @AndrolGenhald correctly pointed out in the comments that's due to PHP short tags) and will still be executed properly. So I guess that php checks the file and if it's a valid php content it will be executed. Though I searched and I didn't find my assumption documented, so if anyone knows that the above assumption is indeed correct please post a link :)

Answer 3

What other formats can PHP be uploaded in?

Assuming you mean file extension and not format, any file extension that is both allowed by the upload code and identified as a PHP script by the PHP server's configuration (Apache httpd's PHP module or PHP-FPM) may be executable. For example, if the server is configured to execute *.php* files, files ending in .php, .php7, and normally invalid ones such as .phpp may be executed.