Learning Web Pentesting With DVWA Part 6: File Inclusion

In this article we are going to go through File Inclusion Vulnerability. Wikipedia defines File Inclusion Vulnerability as: "A file inclusion vulnerability is a type of web vulnerability that is most commonly found to affect web applications that rely on a scripting run time. This issue is caused when an application builds a path to executable code using an attacker-controlled variable in a way that allows the attacker to control which file is executed at run time. A file include vulnerability is distinct from a generic directory traversal attack, in that directory traversal is a way of gaining unauthorized file system access, and a file inclusion vulnerability subverts how an application loads code for execution. Successful exploitation of a file inclusion vulnerability will result in remote code execution on the web server that runs the affected web application."
There are two types of File Inclusion Vulnerabilities, LFI (Local File Inclusion) and RFI (Remote File Inclusion). Offensive Security's Metasploit Unleashed guide describes LFI and RFI as:
"LFI vulnerabilities allow an attacker to read (and sometimes execute) files on the victim machine. This can be very dangerous because if the web server is misconfigured and running with high privileges, the attacker may gain access to sensitive information. If the attacker is able to place code on the web server through other means, then they may be able to execute arbitrary commands.
RFI vulnerabilities are easier to exploit but less common. Instead of accessing a file on the local machine, the attacker is able to execute code hosted on their own machine."
In simpler terms LFI allows us to use the web application's execution engine (say php) to execute local files on the web server and RFI allows us to execute remote files, within the context of the target web server, which can be hosted anywhere remotely (given they can be accessed from the network on which web server is running).
To follow along, click on the File Inclusion navigation link of DVWA, you should see a page like this:
Lets start by doing an LFI attack on the web application.
Looking at the URL of the web application we can see a parameter named page which is used to load different php pages on the website.
http://localhost:9000/vulnerabilities/fi/?page=include.php
Since it is loading different pages we can guess that it is loading local pages from the server and executing them. Lets try to get the famous /etc/passwd file found on every linux, to do that we have to find a way to access it via our LFI. We will start with this:
../etc/passwd
entering the above payload in the page parameter of the URL:
http://localhost:9000/vulnerabilities/fi/?page=../etc/passwd
we get nothing back which means the page does not exist. Lets try to understand what we are trying to accomplish. We are asking for a file named passwd in a directory named etc which is one directory up from our current working directory. The etc directory lies at the root (/) of a linux file system. We tried to guess that we are in a directory (say www) which also lies at the root of the file system, that's why we tried to go up by one directory and then move to the etc directory which contains the passwd file. Our next guess will be that maybe we are two directories deeper, so we modify our payload to be like this:
../../etc/passwd
we get nothing back. We continue to modify our payload thinking we are one more directory deeper.
../../../etc/passwd
no luck again, lets try one more:
../../../../etc/passwd
nop nothing, we keep on going one directory deeper until we get seven directories deep and our payload becomes:
../../../../../../../etc/passwd
which returns the contents of passwd file as seen below:
This just means that we are currently working in a directory which is seven levels deep inside the root (/) directory. It also proves that our LFI is a success. We can also use php filters to get more and more information from the server. For example if we want to get the source code of the web server we can use php wrapper filter for that like this:
php://filter/convert.base64-encode/resource=index.php
We will get a base64 encoded string. Lets copy that base64 encoded string in a file and save it as index.php.b64 (name can be anything) and then decode it like this:
cat index.php.b64 | base64 -d > index.php
We will now be able to read the web application's source code. But you maybe thinking why didn't we simply try to get index.php file without using php filter. The reason is because if we try to get a php file with LFI, the php file will be executed by the php interpreter rather than displayed as a text file. As a workaround we first encode it as base64 which the interpreter won't interpret since it is not php and thus will display the text. Next we will try to get a shell. Before php version 5.2, allow_url_include setting was enabled by default however after version 5.2 it was disabled by default. Since the version of php on which our dvwa app is running on is 5.2+ we cannot use the older methods like input wrapper or RFI to get shell on dvwa unless we change the default settings (which I won't). We will use the file upload functionality to get shell. We will upload a reverse shell using the file upload functionality and then access that uploaded reverse shell via LFI.
Lets upload our reverse shell via File Upload functionality and then set up our netcat listener to listen for a connection coming from the server.
nc -lvnp 9999
Then using our LFI we will execute the uploaded reverse shell by accessing it using this url:
http://localhost:9000/vulnerabilities/fi/?page=../../hackable/uploads/revshell.php
Voila! We have a shell.
To learn more about File Upload Vulnerability and the reverse shell we have used here read Learning Web Pentesting With DVWA Part 5: Using File Upload to Get Shell. Attackers usually chain multiple vulnerabilities to get as much access as they can. This is a simple example of how multiple vulnerabilities (Unrestricted File Upload + LFI) can be used to scale up attacks. If you are interested in learning more about php wrappers then LFI CheetSheet is a good read and if you want to perform these attacks on the dvwa, then you'll have to enable allow_url_include setting by logging in to the dvwa server. That's it for today have fun.
Leave your questions and queries in the comments below.

References:

  1. FILE INCLUSION VULNERABILITIES: https://www.offensive-security.com/metasploit-unleashed/file-inclusion-vulnerabilities/
  2. php://: https://www.php.net/manual/en/wrappers.php.php
  3. LFI Cheat Sheet: https://highon.coffee/blog/lfi-cheat-sheet/
  4. File inclusion vulnerability: https://en.wikipedia.org/wiki/File_inclusion_vulnerability
  5. PHP 5.2.0 Release Announcement: https://www.php.net/releases/5_2_0.php


More information

  1. Physical Pentest Tools
  2. Tools Used For Hacking
  3. Hacker Tool Kit
  4. Hacking Tools Name
  5. Free Pentest Tools For Windows
  6. Hack Tools For Mac
  7. Hak5 Tools
  8. Hacker Tools For Ios
  9. Nsa Hack Tools
  10. Hacking Tools Github
  11. Easy Hack Tools
  12. Hack Website Online Tool
  13. Hacking Tools For Windows Free Download
  14. Pentest Tools Kali Linux
  15. Hacking Tools Download
  16. Nsa Hack Tools
  17. Install Pentest Tools Ubuntu
  18. Kik Hack Tools
  19. Game Hacking
  20. Nsa Hack Tools Download
  21. Hacks And Tools
  22. Hack Tools For Pc
  23. Pentest Tools List
  24. Tools For Hacker
  25. Pentest Tools Windows
  26. Hacker Search Tools
  27. Termux Hacking Tools 2019
  28. Black Hat Hacker Tools
  29. Pentest Tools List
  30. Hacking Tools Download
  31. Pentest Tools Github
  32. Nsa Hack Tools Download
  33. What Are Hacking Tools
  34. Pentest Tools List
  35. Pentest Tools Subdomain
  36. Hack And Tools
  37. Hacking App
  38. Hacking Tools Name
  39. Pentest Tools Online
  40. Hack Tools For Mac
  41. Pentest Tools Android
  42. Hacker Tools 2019
  43. Hacking Tools For Beginners
  44. Hacker Tools Apk Download
  45. What Are Hacking Tools
  46. Hackrf Tools
  47. Pentest Tools For Windows
  48. Hacking Tools For Windows
  49. Hacker Tools 2019
  50. Pentest Tools Website
  51. Pentest Tools Download
  52. Pentest Tools Online
  53. Pentest Automation Tools
  54. Pentest Tools Android
  55. Pentest Tools Port Scanner
  56. Pentest Tools Android
  57. Hacker Techniques Tools And Incident Handling
  58. Pentest Recon Tools
  59. Hacking Tools Windows
  60. Black Hat Hacker Tools
  61. Usb Pentest Tools
  62. Hacker Tools For Windows
  63. Nsa Hack Tools Download
  64. Best Hacking Tools 2020
  65. Game Hacking
  66. Bluetooth Hacking Tools Kali
  67. Pentest Tools Website Vulnerability
  68. Top Pentest Tools
  69. How To Install Pentest Tools In Ubuntu
  70. Hackers Toolbox
  71. Hack Tool Apk
  72. What Are Hacking Tools
  73. Hacking Tools And Software
  74. Pentest Tools Review
  75. Hack Tools 2019
  76. Hack And Tools
  77. Hack Tools Download
  78. Hacking Tools For Windows Free Download
  79. Pentest Tools
  80. Tools For Hacker
  81. Pentest Tools Review
  82. Hack Tools Pc
  83. Pentest Tools For Mac
  84. Hack Tools Mac
  85. Best Hacking Tools 2019
  86. Pentest Tools Download
  87. How To Install Pentest Tools In Ubuntu
  88. Hacker Tools For Ios
  89. Hacker Tool Kit
  90. Blackhat Hacker Tools
  91. Hacking Tools Hardware
  92. Pentest Tools Review
  93. Hack Tools For Windows
  94. Hack App

No comments:

Post a Comment

Labels

14.6.2014 draw 297/14 19 Mei 2013 23 Jun 2013 24.04.2013 25 Jun 2013 4 mei 2014 - draw 278/14 6 mei 2014 Adakah anda bersetuju dengan pernyataan tentang zakar ini? BERIKUT MERUPAKAN NOMBOR RAMALAN UNTUK MAGNUM 4D PADA 30 OGOS 2014 draw 143/13 draw 279/14 DRAW ID 098/13. DRAW ID 099/13: NOMBOR RAMALAN UNTUK MAGNUM 4D PADA 4 MEI 2013 DRAW ID 139/13. DRAW ID 141/13. DRAW ID 142/13 DRAW ID 142/13 / PREDICTION FOR MAGNUM 4D COUNTER ON 3 AUGUST 2013 ID CABUTAN 098/13 / PREDICTION FOR MAGNUM 4D COUNTER ON 1 MAY 2013 ID CABUTAN 099/13 / ID CABUTAN 139/13 / PREDICTION FOR MAGNUM 4D COUNTER ON 27 JULY 2013 ID CABUTAN 141/13 / PREDICTION FOR MAGNUM 4D COUNTER ON 31 JULY 2013 Keputusan dan perbandingan antara nombor ramalan dan result Magnum 4D pada 31 Julai 2013 Keputusan Magnum 4D Kerja part time/ sambilan : Peluang tambah pendapatan Magnum 4d result 1 May 2013 Draw 098/13 Magnum draw 094/13 nombor 4d 6.7.2014 308/14 Nombor 4d untuk hari ini : 21/04/2013 nombor magnum 4d draw 107/13 ; Ahad nombor magnum 4d untuk draw 101/13: 7 mei 2013 ( magnum 4d prediction number for draw 101/13 : 7 may 2013 Nombor ramalan 4d : 24.04.2013 Nombor ramalan dan keputusan Magnum 4D draw 119/13 pada 15 Jun 2013 Nombor ramalan Magnum 4D 4 Ogos 2013 draw 143/13 Nombor ramalan Magnum 4D 7 Ogos 2013 draw 144/13 nombor ramalan Magnum 4D dan result pada 4 Ogos 2013 Nombor ramalan magnum 4d draw 112/13 29 Mei 2013 Nombor ramalan Magnum 4D pada 1 Jun 2013 draw 113/13 nombor ramalan magnum 4d pada 14.6.2014 draw 297/14 Nombor ramalan Magnum 4D pada 2 Jun 2013 Draw 114/13 nombor ramalan magnum 4d pada 23 ogos 2014 draw 329/14 Nombor ramalan magnum 4d pada 26.05.2015 draw 467/15 - special draw Nombor Ramalan Magnum 4D pada 30 April 2014 draw 276/14 nombor ramalan magnum 4d pada 30 ogos 2014 draw 333/14 nombor ramalan magnum 4d pada 4 mei 2014 - draw 278/14 Nombor ramalan magnum 4d pada 5 julai 2014 hari sabtu draw 307/14 nombor ramalan magnum 4d pada 7 september 2014 draw 338/14 ( 7.9.2014/338/14) nombor ramalan magnum 4d pada 8 Februari 2014 (8/2/2014) draw 235/14 nombor ramalan magnum 4d pada hari ahad nombor ramalan magnum 4d pada hari ahad 6 julai 2014 draw 308/14 nombor ramalan magnum 4d pada hari rabu 25 september 2013 draw 168/13 nombor ramalan magnum 4d pada hari rabu 9 julai 2014 draw 309/14 nombor ramalan magnum 4d pada hari sabtu nombor ramalan magnum 4d pada hari sabtu 13.9.2014 draw 340/14 nombor ramalan magnum 4d pada hari sabtu 26 oktober 2013 draw 182/13 nombor ramalan magnum 4d pada hari selasa Nombor ramalan Magnum 4D untuk draw 118/13 pada hari Rabu 12 Jun 2013 Nombor ramalan Magnum 4D untuk draw 119/13 pada hari Sabtu 16 Jun 2013 Nombor ramalan Magnum 4D untuk draw 120/13 pada hari Ahad 16 Jun 2013 Nombor ramalan Magnum 4D untuk draw 121/13 pada hari Rabu 19 Jun 2013. Nombor ramalan Magnum 4D untuk draw 123/13 pada hari Ahad Nombor ramalan Magnum 4D untuk draw 124/13 pada hari Selasa (special draw) Nombor ramalan Magnum 4D untuk draw 231/14 pada hari Sabtu 1 Februari 2014 Nombor ramalan Magnum 4D untuk hari Sabtu 7 Ogos 2013 draw 149/13 Nombor ramalan Magnum 4D untuk hari Selasa 3 September 2013 draw 158/13 | SPECIAL DRAW Nombor ramalan MAGNUM 4D untuk special draw 111/13 28 Mei 2013 Nombor ramalan untuk hari Rabu nombor ramalan untuk MAGNUM 4D Nombor ramalan untuk magnum 4d draw 105/13: 15 Mei 2013 Nombor ramalan untuk magnum 4d draw 120/13 dan keputusan/result magnum 4d pada 16 Jun 2013 NOMBOR RAMALAN UNTUK MAGNUM 4D PADA 1 MEI 2013 NOMBOR RAMALAN UNTUK MAGNUM 4D PADA 27 JULAI 2013 NOMBOR RAMALAN UNTUK MAGNUM 4D PADA 3 OGOS 2013 NOMBOR RAMALAN UNTUK MAGNUM 4D PADA 31 JULAI 2013 nombor ramalan untuk magnun 4d pada 3 mei 2014-277/14 nombor untuk magnum 4d draw 095/13 : 27 April 2013 PREDICTION FOR MAGNUM 4D ON 4 MAY 2013 ramalan magnum 4d 9.7.14 309/14 Ramalan pada 12 Jun 2013 dan keputusan Magnum 4D Result 21.4.2013 Cash Sweep Result 21.4.2013 DaMaCai Result 21.4.2013 Magnum Result 21.4.2013 Toto special draw 28 Mei 2013 special draw pada 28 MEI 2013. TERKINI| TERBARU: nombor magnum 4d 7 mei 2013; 101/13 ; special draw Toto draw 3871/13

**Penafian**

Nombor ramalan hanyalah sebagai panduan dan dicadangkan untuk MAGNUM SAHAJA (atau kaunter lain sekiranya sesuai) . Segala pertaruhan adalah atas risiko anda sendiri.