kyotozx/cve-2024-2961-remote-file-readProof-of-concept exploit for CVE-2024-2961, leveraging iconv encoding flaws and PHP filter chains to read arbitrary files from vulnerable servers via crafted payload uploads.
This script demonstrates how to exploit a vulnerability in systems using the iconv library when it mishandles character encoding conversions, as described in CVE-2024-2961. It allows an attacker to read arbitrary files from the server by taking advantage of PHP filter chains and flawed encoding handling.
The script automates the process of uploading a crafted payload, retrieving the resulting file, and displaying its contents. It builds on the research detailed in the article: Iconv CVE-2024-2961: Exploiting Character Encoding Conversions.
The script follows these steps:
Payload Creation
It creates a PHP filter chain payload that leverages iconv encoding conversions to read any file on the server. This payload is designed to bypass normal restrictions, allowing access to files such as /etc/passwd or other sensitive files.
File Upload
It sends a POST request to the target server's admin-ajax.php endpoint, mimicking an image upload. The payload is hidden within the request so that the server processes it as if it were a legitimate file.
File Download
After uploading the payload, the script downloads the file that now contains the contents of the target file. Finally, it extracts and displays these contents.
requests library (install it with pip install requests)iconv and PHP.Clone the Repository or Download the Script:
git clone https://github.com/kyotozx/CVE-2024-2961-Remote-File-Read.git
cd CVE-2024-2961-Remote-File-Read
Run the Script:
python3 lfi.py
Follow the Prompts:
/etc/passwd).1).What the Script Does:
Remote File Read Exploitation - CVE-2024-2961
Enter the path of the file you want to read (e.g., /etc/passwd): /etc/passwd
Enter a numeric ID for the upload (e.g., 1): 1
File uploaded successfully: http://blog.bigbang.htb/wp-content/uploads/2025/01/1-50.png
File content:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...
This script is intended solely for educational and authorized testing purposes. Do not use it on systems without explicit permission.