PHP Filter Chains: How To Use It

The talk starts from local file inclusion, a bug class where an attacker controls a path that PHP loads. After surveying older tricks and their limits, the speaker introduces PHP filter chains. By stacking conversion filters on the php:// wrapper, an attacker can use iconv encodings to prepend arbitrary bytes to a resource, building a payload that runs commands when it is included.

The second half covers a blind file read that works without any output. Chaining many encodings pushes PHP past its memory limit, and a dechunk filter then reacts differently depending on whether the first character is a hexadecimal digit, giving an error-based oracle. A cp930 codec shifts characters one step at a time, so the first byte of a file can be inferred, and further conversions rotate the content to reach later bytes. The speaker applies this to a file path flaw in the MISP threat-intelligence platform, where user input reached file_get_contents before validation, and shows slow extraction of database credentials from the configuration file.

The takeaway is that any PHP function reading a path can be abused, including unexpected ones such as md5_file, so hiding file contents is not enough. Limits are practical: a GET parameter caps chain length and restricts leaks to roughly 135 characters, and extraction is slow. Code execution needs an include of attacker-controlled input, which is rare, while blind reads are far more widely reachable.