Hunting Path Traversal | Everything you need to know! | Harshit Sharma | Lucideus

Path Traversal 

Local File Inclusion (LFI) also known as path traversal is a vulnerability that can potentially allow an attacker to view sensitive documents or files from the server. It can also lead to Remote Code Execution, Denial of service but before jumping on what local file inclusion or lfi is, let's understand how modern-day web applications handle application files.

File Handling or Inclusion Functions 

Web applications may use files or may include code or view text from files present or hosted on the same server. In order to do that web applications may use a file reading mechanism, For the sake of this blog let's just call the parameter which includes or reads server files as file inclusion function.

For Example


In the above code, the "filename" parameter's job is to read content from the file present on the server and this action of reading file can be influenced by the user. While writing the code the intention of the developer would have been just to manage a user selection and input file or content from files present on the same server, What the developer would not have thought of is that the amount of control he may be giving away to the user. If you observe closely an attacker can abuse the function or feature to ask for any file or to read sensitive data from the server.

NOTE: This is a sample python script, a similar server-side script can be written to do the same.

So depending upon a web application to another the implementation can vary and it can either be a GET method or it could be a POST method. The question is how can a user or a pentester find out these so-called inclusion functions. It is fairly easy to find such inclusion functions during the recon phase or general browsing through the web application would the job.

Given Below are the URL'S which have the so-called "inclusion function" as GET method requests.

http://www.test.com/user/page=one.php
http://www.test.com/index.php?file=content
http://www.test.com/main.cgi?home=index.html
http://www.test.com/main/index.html

Note: It is not always necessary that the url will have an inclusion function you just need to assume that you might be in web server root directory or web document directory.

and POST requests could look something like this





COOKIES!!
So Cookies are an integral part of a web application that helps in making HTTP protocol stateful and do a few other tasks if you want to learn about cookies and session read my previous blog, But Coming back to this "one more thing". Well It turns out cookies can also be used to dynamically generate pages or templates.

Example 


This means that cookies are also in scope for testing for path traversal or file inclusion vulnerability and how do you do that, Well that will come in a bit .....

Why does this Vulnerability Occur?

Now you know many applications use this so-called inclusion functionality to manage images, templates, code, static text. The problem arises when these input parameters or inclusion functions are improperly validated. Attackers take advantage of this and are able to pass payloads(known file paths) which could result in sensitive data leaking out as the inclusion function has the ability to read any file from the server, It can even allow attackers to a remote shell of the server.

How to Hunt Local File Inclusion? 

Finding Path Traversal vulnerability is fairly easy, in order to find such a vulnerability one should be able to perform the following tasks.

  • Enumerate inclusion functions
  • Test the enumerated inclusion functions

Well How can one enumerate inclusion function?, It's easy you just need to keep the following question in your mind.
  • Where are the inclusion functions or file-related parameter in the URL or request body?
  • If you can see unusual file extension in the URL or request body?
Example
http://www.test.com/haha?file=index.html

When you are able to find the inclusion function test it!

Example
http://www.test.com/haha?file=/etc/passwd (known file path)
or
http://www.test.com/main/../../etc/passwd

It is not necessary that you only have to enter "/etc/passwd" you can use all possible guesses for directories and file paths, One can also use "../" to jump back or move to a particular directory.
It is important to keep one thing in mind and that is the recon phase is important for example /etc/passwd file path exists in most Linux and it makes sense when you test the payload on an application running on a Linux server. However, it makes no sense if use "/etc/passwd" payload on an application running on an IIS server as the file does not exist in IIS server. So in layman terms, you need to be agile enough to ask the inclusion function for the file that could possibly exist in that environment.  

Each operating system has a different path separator.

Example

Unix/Linux 
Root Directory: "/"
Directory Separator: "/"

Windows
Root Directory: "<drive letter>:\"
Directory Separator: "\"

Let's Watch it in Action

For testing or practice, you can pick any of the vulnerable apps out there OWASP BWA or DVWA whichever you like. I chose OWASP SKF and Mutillidae and for the demo.

Testing for LFI on Mutillidae Test Case -1 GET Method


</div><div class="separator" style="clear: both; text-align: justify;">In the above test case, it was quite easy to find the file inclusion function and pass on a file path.</div><div style="text-align: left;"><br /></div><h4 style="text-align: left;">Testing For LFI on OWASP SKF Test Case -2 POST Method</h4><div><br /></div><div class="separator" style="clear: both; text-align: center;"><iframe allowfullscreen='allowfullscreen' webkitallowfullscreen='webkitallowfullscreen' mozallowfullscreen='mozallowfullscreen' width='320' height='266' src='https://www.blogger.com/video.g?token=AD6v5dxtM8LoHHb8oUmofK3gbcWhDTlReudxFDUQ_fKaBZ1ZwIikoQ7jDDvFZeW5QhoJRE8kiQ3W3T3wEJGmLs2IJQ' class='b-hbp-video b-uploaded' frameborder='0' /></div><div class="separator" style="clear: both; text-align: justify;"><br /></div><div class="separator" style="clear: both; text-align: justify;">This test case has a POST request and all that was required to perform lfi was to tamper with the request body and request for the file. However, this would not be the case in every other lfi hunting instance.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><br /></div><h4 style="text-align: left;">Testing For LFI on OWASP SKF Test Case -3 POST Method</h4><div class="separator" style="clear: both; text-align: center;"><iframe allowfullscreen='allowfullscreen' webkitallowfullscreen='webkitallowfullscreen' mozallowfullscreen='mozallowfullscreen' width='320' height='266' src='https://www.blogger.com/video.g?token=AD6v5dw1ZvbcCYyjQXTGEeF1m5ZrO8ph7r5ny5SMWh4AdzrvnIUIDWmSTs3kxwtODreyusN8_tIeMs9I2vCSvTWXgw' class='b-hbp-video b-uploaded' frameborder='0' /></div><div style="text-align: left;"><br /></div><div style="text-align: justify;">The goal of different test cases is quite simple and that is that the readers of this blog are able to build an aptitude to hunt file inclusion vulnerability. In the above test case, the developer has implemented a filtering mechanism to filter out "../" so if we fool the logic and modify our payload so that after being filtered out it still makes sense then we will be able to get the data. Instead of using "../../../etc/passwd", I used ".<span style="color: red;">../</span>./.<span style="color: red;">../</span>./.<span style="color: red;">../</span>./etc/passwd so all "<span style="color: red;">../</span>" will be filtered and in the end we will get the data.</div><div style="text-align: justify;"><br /></div><h4 style="text-align: left;">Testing For LFI on OWASP SKF Test Case -4 POST Method</h4><div class="separator" style="clear: both; text-align: center;"><iframe allowfullscreen='allowfullscreen' webkitallowfullscreen='webkitallowfullscreen' mozallowfullscreen='mozallowfullscreen' width='320' height='266' src='https://www.blogger.com/video.g?token=AD6v5dyu_Pe7NWB8SwfASKLG6Cof4aaRSlveGWOmiApCkcmenTQnLTjidbsPdLEDxyPLuylhkm1_-_68sDh0o7Qidw' class='b-hbp-video b-uploaded' frameborder='0' /></div><div style="text-align: left;"><br /></div><div style="text-align: justify;">In this test case, the webserver completely denies all possible combinations of the payload and in the end, the payload is double URL enoded only then the server accepts and gives us the data. So again this is one such scenario to test, So you might have to encode or double encode your payload.</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">Pro Tip: Developers do not expect every form of encoding so they only implement a basic form of encoding. If your payload fails at the first attempt then try harder and keep fuzzing keep changing your payload. You can also use Unicode/UTF-8 encoding if the server accepts UTF8 sequences.</div><div style="text-align: justify;"><br /></div><h4 style="text-align: justify;"><b>Testing For LFI in Cookies Test Case -5</b></h4><div style="text-align: justify;">Testing for path traversal on cookies remains as same as it is for inclusion functions in URLs or POST requests. Refer to the below-given image to understand how to test.</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://1.bp.blogspot.com/-jyaeV1e_CIM/XpA0zIq7vdI/AAAAAAAAAQE/AvsTtb4igeEJc-fwTPiyJkyn9CiZujwVACLcBGAsYHQ/s1600/untitled%2B2020-04-10%2B14-25-59.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="234" data-original-width="894" height="104" src="https://1.bp.blogspot.com/-jyaeV1e_CIM/XpA0zIq7vdI/AAAAAAAAAQE/AvsTtb4igeEJc-fwTPiyJkyn9CiZujwVACLcBGAsYHQ/s400/untitled%2B2020-04-10%2B14-25-59.png" width="400" /></a></div><div style="text-align: left;"><br /></div><h3 style="text-align: left;">DotDotPwn</h3><div style="text-align: justify;">It is actually hard to guess all possible payload or file paths for different environments. Don't worry I got you !!. DotDotPwn is an amazing directory/path traversal fuzz tester. Fuzz Testing is a quality assurance technique that involves sending random data input in massive amounts and get an unexpected response, So DotDotpwn helps with Fuzz or test most of the possible file paths and It also has a feature to that lets the pentester determine the depth of traversal and you also get the option to choose payload according to the os environment and it also supports multiple protocols.</div><div><br /></div><div style="text-align: justify;"><b>Step 1</b> Open Terminal type: dotdotpwn --help</div><div><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://1.bp.blogspot.com/-ZDTZDakDkWA/XpBDK-7n5SI/AAAAAAAAAQQ/MNRYsQSaMIwDNMOy-WQOLJ59pNtVKR6wwCLcBGAsYHQ/s1600/kali-linux-2017.3-vm-amd64%2B2020-04-10%2B15-22-07.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1089" data-original-width="1600" height="433" src="https://1.bp.blogspot.com/-ZDTZDakDkWA/XpBDK-7n5SI/AAAAAAAAAQQ/MNRYsQSaMIwDNMOy-WQOLJ59pNtVKR6wwCLcBGAsYHQ/s640/kali-linux-2017.3-vm-amd64%2B2020-04-10%2B15-22-07.png" width="640" /></a></div><div><br /></div><div style="text-align: justify;"><b>Step 2</b> choose the target and protocol and type the relevant attributes in the command in my case, I tested this tool on Mutillidae and I passed the following command</div><div style="text-align: justify;"><br /></div><div><div><b>dotdotpwn -m http -h 172.16.111.134/mutillidae/index.php?page=</b></div></div><div><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://1.bp.blogspot.com/-XcQ4WHh5YHk/XpBV1vu99KI/AAAAAAAAAQo/NCmNiz-HFYYPjqGqhweOZqs5VgrM3aqYgCLcBGAsYHQ/s1600/kk.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1307" data-original-width="1368" height="609" src="https://1.bp.blogspot.com/-XcQ4WHh5YHk/XpBV1vu99KI/AAAAAAAAAQo/NCmNiz-HFYYPjqGqhweOZqs5VgrM3aqYgCLcBGAsYHQ/s640/kk.png" width="640" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div><br /></div><div><b>Step 3 Hit </b>Enter to launch</div><div><b><br /></b></div><div class="separator" style="clear: both; text-align: center;"><a href="https://1.bp.blogspot.com/-gg-LxVh6iT4/XpBWUr1tDLI/AAAAAAAAAQw/FnbWxnvLhww1uU4F03At6Y4ZQW7JAbYQwCLcBGAsYHQ/s1600/kali-linux-2017.3-vm-amd64%2B2020-04-10%2B16-48-43.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="869" data-original-width="1600" height="347" src="https://1.bp.blogspot.com/-gg-LxVh6iT4/XpBWUr1tDLI/AAAAAAAAAQw/FnbWxnvLhww1uU4F03At6Y4ZQW7JAbYQwCLcBGAsYHQ/s640/kali-linux-2017.3-vm-amd64%2B2020-04-10%2B16-48-43.png" width="640" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://1.bp.blogspot.com/-QormVltjiR8/XpBXGhRG-5I/AAAAAAAAAQ4/I2mLI9fxZg4U9fhBuZb0CD2U-FyTjO-ggCLcBGAsYHQ/s1600/tt.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="950" data-original-width="1600" height="378" src="https://1.bp.blogspot.com/-QormVltjiR8/XpBXGhRG-5I/AAAAAAAAAQ4/I2mLI9fxZg4U9fhBuZb0CD2U-FyTjO-ggCLcBGAsYHQ/s640/tt.png" width="640" /></a></div><div><br /></div><div>and the tool will do all the fuzzing.&nbsp;</div><h3 style="text-align: left;">LFI vs RFI or Are they Same?</h3><div class="separator" style="clear: both; text-align: center;"><a href="https://1.bp.blogspot.com/-R4knMe8-icE/Xo-EbQOmo8I/AAAAAAAAAP0/NVe9-Hp-eZAWEMRCg-vrN3XhzEAszXlIACLcBGAsYHQ/s1600/giphy%2B%25281%2529.gif" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="392" data-original-width="480" height="326" src="https://1.bp.blogspot.com/-R4knMe8-icE/Xo-EbQOmo8I/AAAAAAAAAP0/NVe9-Hp-eZAWEMRCg-vrN3XhzEAszXlIACLcBGAsYHQ/s400/giphy%2B%25281%2529.gif" width="400" /></a></div><div><br /></div><div style="text-align: justify;">A path traversal attack is also known as "directory traversal", "dot-dot-slash", "directory climbing", "backtracking" and local file inclusion. Lets clear the fuss and understand what Local File Inclusion actually is and then we will jump to Remote file Inclusion.</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">Well, both of the vulnerabilities are file inclusion vulnerabilities, it's just how the inclusion function is exploited.</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">In Local File Inclusion, the inclusion function leaks unintentional files present within the server or files that are local to the server. In Remote file inclusion, the attacker passes a URL or file path of a malicious file present in some remote server and the inclusion function loads the malicious file and runs it on its own server and this could result in a remote shell or an XSS attack or maybe the attacker uploads a shell file which allows him to browse directories and whatnot.</div><div style="text-align: justify;"><br /></div></div></div>

Article Link: https://blog.lucideus.com/2020/04/hunting-path-traversal-everything-you.html