dimasma0305/filter-chain-tools

A filter chain based on php + python fuzz and generating procedures.

filterChainFuzzerAndGenerator

English | 简体中文

A fuzz and generator based on php and python filter chain.

Possible use scenarios:

• No document RCE
• CTF The Web in
• CTF The Misc in
• ... (more possible?)

About

You can learn the principle and more details in the doc below

• [idekCTF 2022] Paywall - filter chain construction and extension

Also, thanks for the ideas provided by the following projects

• https://github.com/loknop https://gist.github.com/loknop/b27422d355ea1fd0d90d6dbc1e278d4d
• https://github.com/wupco/PHP_INCLUDE_TO_SHELL_CHAR_DICT
• https://github.com/synacktiv/php_filter_chain_generator

The purpose of each file in the project directory is as follows:

• Fuzzer.php dictionary needed for Fuzz filter chain
  • iconv_list.php Fuzz character set file, you can customize the corresponding encoding set according to the scene
  • Init Fuzzer includes files, basically no need to change
• Generator.py Filter chain for generating arbitrary payloads
• List of dictionaries in aview.py output .res folder
• get_dic.py convert single-character files in the .res folder to a custom dictionary.py dictionary
• dictionary.py single character dictionary, can be customized, default use get_dic.py generation

Usage

Fuzz

Fuzz relies on Fuzzer.php

Define the character set you need for fuzz in iconv_list.php

Select the corresponding character set according to the corresponding environment:

iconv -l

Set the parameters in the Fuzzer.php:

Start Fuzz with the following command:

php Fuzzer.php

Generator

Filter chain generation relies on Generator.py implementation.

Two modes are currently available:

• Chain generation using the original hexcode encoded letters in the .res folder
• Using dictionary generation in dictionary.py

If you want to use the first mode, the dictionary corresponding to hexcode is included with the project download, just set the parameters at the beginning of the file:

Of course, you can also generate your own according to the project principle.

If you use the second mode, the project also prepared a Fuzz good word dictionary in dictionary.py:

You can also Fuzz according to your own needs, the process is roughly as follows:

• Set the required character set
• Run Fuzzer.php
• Use get_dic.py to extract the running dictionary from .res

Of course, if you are familiar with the principle, you can also use the method you want to modify the dictionary file dictionary.py.

When everything is ready, use the following command directly:

python Generator.py

That's it.