title: Bypass string concat in PHP readfile for LFD exploit
body: <p>I'm taking a course on software security and have been presented with the following scenario:</p>
  
  <p>PHP CODE RUNNING ON SERVER:</p>
  
  <pre class="lang-php prettyprint-override"><code>&lt;?php 
      header("Content-Type: application/octet-stream");
      header("Content-Disposition: attachment; filename=response.txt");
      readfile($_GET['file']."/remove/this.txt");
  ?&gt;
  </code></pre>
  
  <p>I need to know if this can be exploited to get an arbitrary file on the server (other than */remove/this.txt).</p>
  
  <p>I tried using null byte (%00) but it's not working (the apache server is running PHP 5.3 on Ubuntu).</p>
  
  <p>I also tried to get creative with php://filter, php://input, etc and nothing. The problem here is that the last part of the instruction is the resource.</p>
  
  <p>Path truncation doesn't seem to work either. For now the only thing I can do is read URL's using ?var=... </p>