Local File Inclusion
Local file inclusion (LFI) is a web security vulnerability that allows attackers to read and upload files onto a server via a web browser.
- This vulnerability can be exploited to add or replace locally available files on the server, including configuration files, code files, logs, and other sensitive data.
- It often occurs when an application permits file inclusion solely based on user input without additional security checks, enabling attackers to manipulate the input and inject path traversal characters.
LFI and Path Traversal
- Both LFI and Path Traversal involve the manipulation of file paths to gain access to restricted files on the server. An attacker can use Path Traversal to navigate the file system and find files that should not be accessible (like system configuration files, logs, or sensitive data).
curl -k -X PUT -H "Host: <IP>" --basic -u <username>:<password> --data-binary "PoC." --path-as-is https://<IP>/../../../../../../whoops
| Step | Directory Traversal | Concept of Attacks - Category |
1. | The user specifies the type of HTTP request with the file's content, including escaping characters to break out of the restricted area. | Source |
2. | The changed type of HTTP request, file contents, and path entered by the user are taken over and processed by the process. | Process |
3. | The application checks whether the user is authorized to be in the specified path. Since the restrictions only apply to a specific folder, all permissions granted to it are bypassed as it breaks out of that folder using the directory traversal. | Privileges |
4. | The destination is another process that has the task of writing the specified contents of the user on the local system. | Destination |
Arbitrary File Write
| Step | Arbitrary File Write | Concept of Attacks - Category |
5. | The same information that the user entered is used as the source. In this case, the filename (whoops) and the contents (--data-binary "PoC."). | Source |
6. | The process takes the specified information and proceeds to write the desired content to the specified file. | Process |
7. | Since all restrictions were bypassed during the directory traversal vulnerability, the service approves writing the contents to the specified file. | Privileges |
8. | The filename specified by the user (whoops) with the desired content ("PoC.") now serves as the destination on the local system. | Destination |
Examples
get_file() { curl -s http://titanic.htb/download?ticket=../../../$1; }
python3 exploit.py --cgi --ip 103.140.180.22 --port 80 --path "/etc/shadow"