Bypass string concat in PHP readfile for LFD exploit

Question

I'm taking a course on software security and have been presented with the following scenario:

PHP CODE RUNNING ON SERVER:

<?php 
    header("Content-Type: application/octet-stream");
    header("Content-Disposition: attachment; filename=response.txt");
    readfile($_GET['file']."/remove/this.txt");
?>

I need to know if this can be exploited to get an arbitrary file on the server (other than */remove/this.txt).

I tried using null byte (%00) but it's not working (the apache server is running PHP 5.3 on Ubuntu).

I also tried to get creative with php://filter, php://input, etc and nothing. The problem here is that the last part of the instruction is the resource.

Path truncation doesn't seem to work either. For now the only thing I can do is read URL's using ?var=...

Answer 1

I just ran a simple test and can say there isn't a single character exploit for this that would chop off the last filename part. Example:

<pre>
<?php

for($i=0;$i<=255;$i++){
    $chr = chr($i);

    readfile("B.txt{$chr}A.txt");
}

Created a file called A.txt that is the standard file and B.txt that is the target file. Put something noticeable in each file so you know when it was read (I already had the files for something else and there was a different list of like 100 items in each).

There wasn't a single character exploit on my system which is RHEL6. The obvious exploit would be if the file remove/this.txt existed elsewhere and you could redirect to a different directory.