viernes, 21 de agosto de 2020

Learning Web Pentesting With DVWA Part 6: File Inclusion

In this article we are going to go through File Inclusion Vulnerability. Wikipedia defines File Inclusion Vulnerability as: "A file inclusion vulnerability is a type of web vulnerability that is most commonly found to affect web applications that rely on a scripting run time. This issue is caused when an application builds a path to executable code using an attacker-controlled variable in a way that allows the attacker to control which file is executed at run time. A file include vulnerability is distinct from a generic directory traversal attack, in that directory traversal is a way of gaining unauthorized file system access, and a file inclusion vulnerability subverts how an application loads code for execution. Successful exploitation of a file inclusion vulnerability will result in remote code execution on the web server that runs the affected web application."
There are two types of File Inclusion Vulnerabilities, LFI (Local File Inclusion) and RFI (Remote File Inclusion). Offensive Security's Metasploit Unleashed guide describes LFI and RFI as:
"LFI vulnerabilities allow an attacker to read (and sometimes execute) files on the victim machine. This can be very dangerous because if the web server is misconfigured and running with high privileges, the attacker may gain access to sensitive information. If the attacker is able to place code on the web server through other means, then they may be able to execute arbitrary commands.
RFI vulnerabilities are easier to exploit but less common. Instead of accessing a file on the local machine, the attacker is able to execute code hosted on their own machine."
In simpler terms LFI allows us to use the web application's execution engine (say php) to execute local files on the web server and RFI allows us to execute remote files, within the context of the target web server, which can be hosted anywhere remotely (given they can be accessed from the network on which web server is running).
To follow along, click on the File Inclusion navigation link of DVWA, you should see a page like this:
Lets start by doing an LFI attack on the web application.
Looking at the URL of the web application we can see a parameter named page which is used to load different php pages on the website.
http://localhost:9000/vulnerabilities/fi/?page=include.php
Since it is loading different pages we can guess that it is loading local pages from the server and executing them. Lets try to get the famous /etc/passwd file found on every linux, to do that we have to find a way to access it via our LFI. We will start with this:
../etc/passwd
entering the above payload in the page parameter of the URL:
http://localhost:9000/vulnerabilities/fi/?page=../etc/passwd
we get nothing back which means the page does not exist. Lets try to understand what we are trying to accomplish. We are asking for a file named passwd in a directory named etc which is one directory up from our current working directory. The etc directory lies at the root (/) of a linux file system. We tried to guess that we are in a directory (say www) which also lies at the root of the file system, that's why we tried to go up by one directory and then move to the etc directory which contains the passwd file. Our next guess will be that maybe we are two directories deeper, so we modify our payload to be like this:
../../etc/passwd
we get nothing back. We continue to modify our payload thinking we are one more directory deeper.
../../../etc/passwd
no luck again, lets try one more:
../../../../etc/passwd
nop nothing, we keep on going one directory deeper until we get seven directories deep and our payload becomes:
../../../../../../../etc/passwd
which returns the contents of passwd file as seen below:
This just means that we are currently working in a directory which is seven levels deep inside the root (/) directory. It also proves that our LFI is a success. We can also use php filters to get more and more information from the server. For example if we want to get the source code of the web server we can use php wrapper filter for that like this:
php://filter/convert.base64-encode/resource=index.php
We will get a base64 encoded string. Lets copy that base64 encoded string in a file and save it as index.php.b64 (name can be anything) and then decode it like this:
cat index.php.b64 | base64 -d > index.php
We will now be able to read the web application's source code. But you maybe thinking why didn't we simply try to get index.php file without using php filter. The reason is because if we try to get a php file with LFI, the php file will be executed by the php interpreter rather than displayed as a text file. As a workaround we first encode it as base64 which the interpreter won't interpret since it is not php and thus will display the text. Next we will try to get a shell. Before php version 5.2, allow_url_include setting was enabled by default however after version 5.2 it was disabled by default. Since the version of php on which our dvwa app is running on is 5.2+ we cannot use the older methods like input wrapper or RFI to get shell on dvwa unless we change the default settings (which I won't). We will use the file upload functionality to get shell. We will upload a reverse shell using the file upload functionality and then access that uploaded reverse shell via LFI.
Lets upload our reverse shell via File Upload functionality and then set up our netcat listener to listen for a connection coming from the server.
nc -lvnp 9999
Then using our LFI we will execute the uploaded reverse shell by accessing it using this url:
http://localhost:9000/vulnerabilities/fi/?page=../../hackable/uploads/revshell.php
Voila! We have a shell.
To learn more about File Upload Vulnerability and the reverse shell we have used here read Learning Web Pentesting With DVWA Part 5: Using File Upload to Get Shell. Attackers usually chain multiple vulnerabilities to get as much access as they can. This is a simple example of how multiple vulnerabilities (Unrestricted File Upload + LFI) can be used to scale up attacks. If you are interested in learning more about php wrappers then LFI CheetSheet is a good read and if you want to perform these attacks on the dvwa, then you'll have to enable allow_url_include setting by logging in to the dvwa server. That's it for today have fun.
Leave your questions and queries in the comments below.

References:

  1. FILE INCLUSION VULNERABILITIES: https://www.offensive-security.com/metasploit-unleashed/file-inclusion-vulnerabilities/
  2. php://: https://www.php.net/manual/en/wrappers.php.php
  3. LFI Cheat Sheet: https://highon.coffee/blog/lfi-cheat-sheet/
  4. File inclusion vulnerability: https://en.wikipedia.org/wiki/File_inclusion_vulnerability
  5. PHP 5.2.0 Release Announcement: https://www.php.net/releases/5_2_0.php


Related links


  1. Termux Hacking Tools 2019
  2. Hacker Tools For Windows
  3. What Are Hacking Tools
  4. Black Hat Hacker Tools
  5. Best Hacking Tools 2020
  6. Hacking Tools For Windows
  7. Pentest Tools Free
  8. Hacking Tools Hardware
  9. Hacking Tools For Mac
  10. Best Hacking Tools 2020
  11. Nsa Hack Tools
  12. Hacking Tools And Software
  13. Hacker Tools Mac
  14. Hacker Tools Software
  15. Hack Tools
  16. Hack Tools Online
  17. Pentest Tools Free
  18. Pentest Tools Linux
  19. Tools 4 Hack
  20. Best Pentesting Tools 2018
  21. Hacking Tools And Software
  22. Pentest Tools Android
  23. Hacker Tools Apk
  24. Hack Tools Mac
  25. Computer Hacker
  26. Free Pentest Tools For Windows
  27. Pentest Tools Find Subdomains
  28. Hacker Tools Apk Download
  29. Hacking Tools Download
  30. Hack Tools For Games
  31. Hacking Tools Online
  32. Underground Hacker Sites
  33. Hacker Hardware Tools
  34. Ethical Hacker Tools
  35. How To Install Pentest Tools In Ubuntu
  36. Pentest Tools Android
  37. Wifi Hacker Tools For Windows
  38. Hacking Tools Kit
  39. Hacking Tools 2019
  40. Tools Used For Hacking
  41. Hacks And Tools
  42. What Is Hacking Tools
  43. Pentest Tools For Ubuntu
  44. Hacking Tools For Pc
  45. Hacker Tools Apk
  46. Pentest Box Tools Download
  47. Hacker Tools Github
  48. Hacking Tools Hardware
  49. Pentest Tools Subdomain
  50. Termux Hacking Tools 2019
  51. Hacker Tool Kit
  52. Hack Tools For Pc
  53. Android Hack Tools Github
  54. Tools For Hacker
  55. Hack Tools Pc
  56. Best Pentesting Tools 2018
  57. Game Hacking
  58. Nsa Hack Tools Download
  59. Top Pentest Tools
  60. Tools Used For Hacking
  61. Kik Hack Tools
  62. Hack Tools Github
  63. Hacking Tools Usb
  64. Hack Tool Apk No Root
  65. Hacking Tools Usb
  66. Hack Tools Download
  67. Blackhat Hacker Tools
  68. Top Pentest Tools
  69. Pentest Tools Open Source
  70. Hackrf Tools
  71. Hacker Tools 2019
  72. Physical Pentest Tools
  73. Hacker Tools Software
  74. Hacking Tools And Software
  75. Hacker Tools Windows
  76. Hacker Tools Mac
  77. Pentest Tools Github
  78. Hackers Toolbox
  79. Pentest Tools Tcp Port Scanner
  80. Wifi Hacker Tools For Windows
  81. Hack Tools For Mac
  82. Android Hack Tools Github
  83. Github Hacking Tools
  84. Hacker Tools Apk
  85. Hacker Tools Linux
  86. Best Pentesting Tools 2018
  87. Hacking Tools For Windows
  88. Hacking Tools Free Download
  89. Pentest Tools For Windows
  90. Hacker Tool Kit
  91. Hack Tools Mac
  92. Hacker Tools
  93. Hackers Toolbox
  94. How To Hack
  95. Free Pentest Tools For Windows
  96. Hacking Tools 2020
  97. Black Hat Hacker Tools
  98. Hacking App
  99. Hack Tools Pc
  100. Pentest Tools Free
  101. Github Hacking Tools
  102. Hacking Tools And Software
  103. Hack Tools For Ubuntu
  104. Hacking Tools For Windows Free Download
  105. Pentest Tools
  106. Hacker Tools Free Download
  107. Hacker Tools 2019
  108. Hack Tools 2019
  109. Best Pentesting Tools 2018
  110. Hack Tools For Ubuntu
  111. Hacker Tools For Ios
  112. Hacking Tools Online
  113. Tools Used For Hacking
  114. What Is Hacking Tools
  115. Hacker Tools Software
  116. Hacker Tools Online
  117. Hacker
  118. Usb Pentest Tools
  119. Pentest Tools For Ubuntu
  120. Hacking Tools Pc
  121. Hacker Tools Software
  122. Pentest Tools Android
  123. New Hack Tools
  124. Hacker Tools For Pc
  125. Pentest Tools For Windows
  126. Hacker Tools Apk
  127. Hack Tools
  128. Hack Tools Online
  129. Hacking Tools Software
  130. Pentest Reporting Tools
  131. Hak5 Tools
  132. Pentest Tools For Mac
  133. Hacker Tools For Windows
  134. How To Hack
  135. Physical Pentest Tools
  136. Pentest Tools For Ubuntu
  137. Hacking Tools
  138. Hacker Tools Linux
  139. Kik Hack Tools
  140. Pentest Tools Subdomain
  141. Hacking Tools
  142. Beginner Hacker Tools
  143. Pentest Tools Tcp Port Scanner
  144. Hacker Search Tools
  145. Hacking Tools And Software
  146. Pentest Tools For Ubuntu
  147. Pentest Tools Apk
  148. Hacking Tools Name
  149. Hacking Tools For Beginners
  150. Pentest Tools Nmap
  151. Hacker Techniques Tools And Incident Handling
  152. Pentest Tools For Mac
  153. Hacker Tools For Mac
  154. Hacking Tools 2019
  155. Best Hacking Tools 2020
  156. Hacking App

No hay comentarios:

Publicar un comentario