Learn the basics of local file inclusion
đź’˘ We will cover the topics
- Local File Inclusion
- Directory Traversal
- Log Poisoning
Local File Inclusion
What is LFI?
LFI (local file inclusion) is a vulnerability which an attacker can exploit to include/read files.
Why this happens?
LFI occurs when an application uses the path to a file as input. If the application treats this input as trusted, a local file may be used in the include statement.
Possible impact
You might consider this is not a serious threat, but exploit LFI can lead to:
- [-] Denial of service
- [-] Remote code execution
- [-] Sensitive information disclosure
- Let’s get to the basics! Start the VM and access it using your browser. Note: It might take a few minutes to boot
No answer needed
- Access the first walkthrough, and add a parameter at the end of the link named “?page=”.
No answer needed
- Let’s include the home page. At the “?page=” parameter enter home.html to include the home page.
No answer needed
- What’s the message you get when you include the home.html?
http://10.10.141.166/lfi/lfi.php?page=home.html
You included home.html
- You can also read other system files. For example, you can read the passwd file. Type /etc/passwd in the parameter to read it. It should be similar to this:
No answer needed
- What user that it’s not by default there is present?
http://10.10.141.166/lfi/lfi.php?page=/etc/passwd
view-source:http://10.10.141.166/lfi/lfi.php?page=/etc/passwd
| |
lfi
- Well done! You’ve exploited your first local file inclusion! Here is a piece of vulnerable code if you’re interested in how it looks:
No answer needed
Local File Inclusion using Directory Traversal
Let’s exploit a LFI vulnerability leveraging Directory Traversal.
What is Directory Traversal?
Directory traversal or Path Traversal is an HTTP attack which allows attackers to access restricted directories and execute commands outside of the web server’s root directory or other paths.
- Now that we know what Directory Traversal is, let’s access the second walkthrough.
No answer needed
- Add the “?page=” parameter, and try to include the home page again. Does it work (Yes/No)?
http://10.10.141.166/lfi2/lfi.php?page=home.html
no
- Suppose you have another page named “creditcard”, but it’s which is in another directory. Let’s try finding it. Navigate one directory up, and try to include the file. Use “../” to move one directory up.
No answer needed
- What are the credit card numbers?
http://10.10.141.166/lfi2/lfi.php?page=../creditcard
1111-2222-3333-4444
- The same way you can include the passwd file. You’ll have to move more directories up. Try reading the passwd file.
No answer needed
- Well done! You’ve exploited your first LFI using Directory Traversal. Here is a vulnerable piece of code if you’re interested in how it looks like:
No answer needed
Reaching RCE using LFI and log poisoning
What is log poisoning?
Log Poisoning is a common technique used to gain a reverse shell from a LFI vulnerability. To make it work an attacker attempts to inject malicious input to the server log.
This is how the apache log file looks like to have the ability to use log poisoning:
- We got our hands a bit dirty with basic LFI and LFI using path traversal. Let’s dig a little deeper, and use log poisoning to get access to the underlying operating system.
No answer needed
- We will inject some malicious php code into the server’s log. Note: In order for that to happen, the directory should have read and execute permissions.
No answer needed
- Access the third walkthrough, add the “?page=” parameter and let’s try reading the apache log file. The log file is located at the following path: /var/log/apache2/access.log
No answer needed
- Can you read the log (Yes/No)?
http://10.10.141.166/lfi/lfi.php?page=/var/log/apache2/access.log
| |
Yes
- Since you can do it, let’s “poison” it! Fire up Burpsuite and intercept the request (Burp usage is not mandatory, I just like using Burp a lot. You can use ZAP, or other tools you like). Let’s insert the following malicious code in the user agent field (The PHP command will allow us to execute system commands by parsing the input to a GET parameter called lfi):
Forward the request and add your parameter to the link (in my case lfi). The link becomes: http://<IP>/lfi/lfi.php?page=/var/log/apache2/access.log&lfi= Now you can execute commands on the system! Note: In case you don’t like the how the output looks as you execute commands, you can press CTRL+U (view source). It will look better.
| |
| |
No answer needed
- Give it a try and run uname -r. What’s the output of the command?
| |
4.15.0-72-generic
- With this knowledge read the flag from the lfi user home directory.
| |
10.8.106.222 - - [28/Sep/2020:11:02:22 -0700] "GET /lfi/lfi.php?page=/var/log/apache2/access.log&lfi=cat%20/home/lfi/flag.txt HTTP/1.1" 200 1286 "-" "Mozilla/5.0 THM{a352a5c2acfd22251c3a94105b718fea} Firefox/68.0"
THM{a352a5c2acfd22251c3a94105b718fea}
- There is way more in LFI exploitation. Here we barely scratched the surface. But I encourage you to do more research. Below is what I consider to be the best resource which covers everything related to LFI from basic to advanced: A huge collection of information regarding LFI
No answer needed