Wednesday, May 31, 2023

Learning Web Pentesting With DVWA Part 6: File Inclusion

In this article we are going to go through File Inclusion Vulnerability. Wikipedia defines File Inclusion Vulnerability as: "A file inclusion vulnerability is a type of web vulnerability that is most commonly found to affect web applications that rely on a scripting run time. This issue is caused when an application builds a path to executable code using an attacker-controlled variable in a way that allows the attacker to control which file is executed at run time. A file include vulnerability is distinct from a generic directory traversal attack, in that directory traversal is a way of gaining unauthorized file system access, and a file inclusion vulnerability subverts how an application loads code for execution. Successful exploitation of a file inclusion vulnerability will result in remote code execution on the web server that runs the affected web application."
There are two types of File Inclusion Vulnerabilities, LFI (Local File Inclusion) and RFI (Remote File Inclusion). Offensive Security's Metasploit Unleashed guide describes LFI and RFI as:
"LFI vulnerabilities allow an attacker to read (and sometimes execute) files on the victim machine. This can be very dangerous because if the web server is misconfigured and running with high privileges, the attacker may gain access to sensitive information. If the attacker is able to place code on the web server through other means, then they may be able to execute arbitrary commands.
RFI vulnerabilities are easier to exploit but less common. Instead of accessing a file on the local machine, the attacker is able to execute code hosted on their own machine."
In simpler terms LFI allows us to use the web application's execution engine (say php) to execute local files on the web server and RFI allows us to execute remote files, within the context of the target web server, which can be hosted anywhere remotely (given they can be accessed from the network on which web server is running).
To follow along, click on the File Inclusion navigation link of DVWA, you should see a page like this:
Lets start by doing an LFI attack on the web application.
Looking at the URL of the web application we can see a parameter named page which is used to load different php pages on the website.
http://localhost:9000/vulnerabilities/fi/?page=include.php 
Since it is loading different pages we can guess that it is loading local pages from the server and executing them. Lets try to get the famous /etc/passwd file found on every linux, to do that we have to find a way to access it via our LFI. We will start with this:
../etc/passwd 
entering the above payload in the page parameter of the URL:
http://localhost:9000/vulnerabilities/fi/?page=../etc/passwd 
we get nothing back which means the page does not exist. Lets try to understand what we are trying to accomplish. We are asking for a file named passwd in a directory named etc which is one directory up from our current working directory. The etc directory lies at the root (/) of a linux file system. We tried to guess that we are in a directory (say www) which also lies at the root of the file system, that's why we tried to go up by one directory and then move to the etc directory which contains the passwd file. Our next guess will be that maybe we are two directories deeper, so we modify our payload to be like this:
../../etc/passwd 
we get nothing back. We continue to modify our payload thinking we are one more directory deeper.
../../../etc/passwd 
no luck again, lets try one more:
../../../../etc/passwd 
nop nothing, we keep on going one directory deeper until we get seven directories deep and our payload becomes:
../../../../../../../etc/passwd 
which returns the contents of passwd file as seen below:
This just means that we are currently working in a directory which is seven levels deep inside the root (/) directory. It also proves that our LFI is a success. We can also use php filters to get more and more information from the server. For example if we want to get the source code of the web server we can use php wrapper filter for that like this:
php://filter/convert.base64-encode/resource=index.php 
We will get a base64 encoded string. Lets copy that base64 encoded string in a file and save it as index.php.b64 (name can be anything) and then decode it like this:
cat index.php.b64 | base64 -d > index.php 
We will now be able to read the web application's source code. But you maybe thinking why didn't we simply try to get index.php file without using php filter. The reason is because if we try to get a php file with LFI, the php file will be executed by the php interpreter rather than displayed as a text file. As a workaround we first encode it as base64 which the interpreter won't interpret since it is not php and thus will display the text. Next we will try to get a shell. Before php version 5.2, allow_url_include setting was enabled by default however after version 5.2 it was disabled by default. Since the version of php on which our dvwa app is running on is 5.2+ we cannot use the older methods like input wrapper or RFI to get shell on dvwa unless we change the default settings (which I won't). We will use the file upload functionality to get shell. We will upload a reverse shell using the file upload functionality and then access that uploaded reverse shell via LFI.
Lets upload our reverse shell via File Upload functionality and then set up our netcat listener to listen for a connection coming from the server.
nc -lvnp 9999 
Then using our LFI we will execute the uploaded reverse shell by accessing it using this url:
http://localhost:9000/vulnerabilities/fi/?page=../../hackable/uploads/revshell.php 
Voila! We have a shell.
To learn more about File Upload Vulnerability and the reverse shell we have used here read Learning Web Pentesting With DVWA Part 5: Using File Upload to Get Shell. Attackers usually chain multiple vulnerabilities to get as much access as they can. This is a simple example of how multiple vulnerabilities (Unrestricted File Upload + LFI) can be used to scale up attacks. If you are interested in learning more about php wrappers then LFI CheetSheet is a good read and if you want to perform these attacks on the dvwa, then you'll have to enable allow_url_include setting by logging in to the dvwa server. That's it for today have fun.
Leave your questions and queries in the comments below.

References:

  1. FILE INCLUSION VULNERABILITIES: https://www.offensive-security.com/metasploit-unleashed/file-inclusion-vulnerabilities/
  2. php://: https://www.php.net/manual/en/wrappers.php.php
  3. LFI Cheat Sheet: https://highon.coffee/blog/lfi-cheat-sheet/
  4. File inclusion vulnerability: https://en.wikipedia.org/wiki/File_inclusion_vulnerability
  5. PHP 5.2.0 Release Announcement: https://www.php.net/releases/5_2_0.php


More articles


  1. Pentest Automation Tools
  2. Pentest Tools Website
  3. Hacks And Tools
  4. What Is Hacking Tools
  5. Pentest Tools Subdomain
  6. Hacker Techniques Tools And Incident Handling
  7. Black Hat Hacker Tools
  8. Pentest Tools Apk
  9. Hacking Tools For Pc
  10. Hacker Security Tools
  11. Hacking Tools Mac
  12. Pentest Tools For Android
  13. Hacking Tools Windows
  14. Hacking Tools For Beginners
  15. Wifi Hacker Tools For Windows
  16. Pentest Recon Tools
  17. Beginner Hacker Tools
  18. Hacking Tools Pc
  19. Hack App
  20. Hacker Tools For Mac
  21. Hacking Tools Online
  22. Nsa Hack Tools Download
  23. Hacker Tools Hardware
  24. Hacker Tools Github
  25. Pentest Tools Port Scanner
  26. What Are Hacking Tools
  27. Hacker Security Tools
  28. How To Install Pentest Tools In Ubuntu
  29. Hacker Tools For Windows
  30. Hack Tools For Ubuntu
  31. New Hacker Tools
  32. Hacking Tools For Windows 7
  33. Pentest Tools List
  34. Physical Pentest Tools
  35. New Hack Tools
  36. Easy Hack Tools
  37. Hacker Tools For Pc
  38. Tools For Hacker
  39. Install Pentest Tools Ubuntu
  40. Pentest Tools Port Scanner
  41. World No 1 Hacker Software
  42. Hack Tools Mac
  43. Install Pentest Tools Ubuntu
  44. Hack Tools Pc
  45. Hacker
  46. Pentest Tools Find Subdomains
  47. Best Hacking Tools 2019
  48. Hack Tools Github
  49. Pentest Tools Tcp Port Scanner
  50. Hacking Tools For Windows 7
  51. How To Hack
  52. Hacking Tools For Windows
  53. Hacking Tools And Software
  54. Usb Pentest Tools
  55. Pentest Tools Online
  56. Pentest Tools List
  57. Pentest Tools Framework
  58. Hacking Tools 2019
  59. Install Pentest Tools Ubuntu
  60. What Is Hacking Tools
  61. Hacker Tools Free
  62. Pentest Tools Find Subdomains
  63. Pentest Tools Windows
  64. Underground Hacker Sites
  65. Hack Tools For Windows
  66. New Hacker Tools
  67. Hacker Tools 2019
  68. What Are Hacking Tools
  69. Hacker Tools For Ios
  70. Pentest Tools
  71. Hacking Tools And Software
  72. Hack Tools 2019
  73. Hacker Tools For Windows
  74. Hacker Tools Apk Download
  75. Hacking Tools Online
  76. Hacker Tools Apk
  77. Black Hat Hacker Tools
  78. Hacker Tools Windows
  79. Termux Hacking Tools 2019
  80. Hacker Tools Mac
  81. Hacking Tools Kit
  82. Hacking Tools For Windows
  83. Pentest Tools Free
  84. Nsa Hack Tools
  85. Pentest Tools Windows
  86. Hack Tools
  87. Ethical Hacker Tools
  88. World No 1 Hacker Software
  89. Best Hacking Tools 2020
  90. Best Hacking Tools 2020
  91. Pentest Tools Framework
  92. Hacking Tools Free Download
  93. Nsa Hacker Tools
  94. Pentest Recon Tools
  95. Pentest Tools Bluekeep
  96. Pentest Tools Android
  97. Tools Used For Hacking
  98. Hacker Tools For Ios
  99. Pentest Tools
  100. Pentest Tools Framework
  101. Hack Tools Github
  102. Hacking Tools Free Download
  103. Pentest Tools For Android
  104. Termux Hacking Tools 2019
  105. Pentest Tools Port Scanner
  106. Hacker Tools Apk
  107. Hacking Tools Windows 10
  108. Pentest Tools Review
  109. Bluetooth Hacking Tools Kali
  110. Pentest Tools Subdomain
  111. Hacking App
  112. Hacking Tools Usb
  113. Hacker Tools Hardware
  114. Hacker Tools Free
  115. Pentest Tools Url Fuzzer
  116. Pentest Tools Find Subdomains
  117. Nsa Hack Tools Download
  118. Hacking Tools Usb
  119. Hacking Tools Windows
  120. Hackers Toolbox
  121. Hack Tools Download
  122. Hack Tools For Mac
  123. Hack Website Online Tool
  124. Pentest Tools Review
  125. Hacker Tools Online
  126. Pentest Tools Url Fuzzer
  127. Hacking Tools Software
  128. Tools Used For Hacking
  129. Tools 4 Hack
  130. Hacking App
  131. Hacking Tools 2020
  132. Underground Hacker Sites
  133. Pentest Tools Framework
  134. Hack Tools Download
  135. Pentest Tools Online
  136. Hacking Tools 2020
  137. Hack Tools Github
  138. Pentest Tools
  139. Hacker Tools Mac
  140. Pentest Tools Alternative
  141. Hacker Tools 2019
  142. Hacking Tools Mac
  143. Hacker Tools Apk
  144. World No 1 Hacker Software
  145. Pentest Tools Tcp Port Scanner
  146. Pentest Tools Nmap
  147. Pentest Tools Find Subdomains
  148. Hacker Tools Online
  149. Pentest Tools Android
  150. Hacking Tools For Mac
  151. Hak5 Tools
  152. Tools Used For Hacking
  153. Hack App
  154. Underground Hacker Sites
  155. Ethical Hacker Tools
  156. Underground Hacker Sites
  157. Hacker Tools Free Download
  158. Top Pentest Tools
  159. How To Make Hacking Tools
  160. Hacker Search Tools
  161. Pentest Tools Framework
  162. Hack Tools Pc
  163. Hacking Apps
  164. Hack And Tools
  165. Pentest Tools Website Vulnerability
  166. Hacking Tools For Windows
  167. Best Hacking Tools 2020
  168. Pentest Tools

No comments: