+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [TUT] Local file inclusion without NULL-byte. (/showthread.php?tid=2189770)
Pages: Pages
1
2
[TUT] Local file inclusion without NULL-byte. - AntiPaste - Feb 7, 2012
Index
- 0x00 - Introduction
- 0x01 - Summary
- 0x02 - Exploitation
- 0x03 - Ending words
0x00 - Introduction
Greetings.
Basically what I'm about to demonstrate is a vulnerability in PHP versions up to and including 5.2.8 with Suhosin patch 0.9.6.3. The vulnerability allows for local file inclusion without the well-known, and patched, NULL-byte injection and affects at least the following functions: fopen, include(_once), require(_once), file_put_contents and file_get_contents.
This tutorial will not have a vast technical explanation on what's happening behind the scenes. If you're interested in that, you can read the full vulnerability write up at http://www.ush.it/2009/02/08/php-filesystem-attack-vectors/.
Let's begin.
0x01 - Summary
First off, a brief summary of the vulnerability.
PHP truncates paths used by filesystem functions, by default, into 4096 bytes. Thus by filling the buffer, we basically remove whatever is left at the end of the path sent as an argument to the function. This is what NULL-byte injection achieves as well, but differently. NULL-byte injection relies on C-based language's way of handling NULL-bytes as the end of a string, this vulnerability is a flaw in PHP itself, a design error.
The ideal way to fill the buffer is with "/." strings and this is the string this tutorial will be using.
0x02 - Exploitation
To start with, let's find ourselves an LFI vulnerable site.
http://www.becrux.com/index.php?page=projects just happens to be vulnerable to LFI in the page-parameter, as adding any character to the end of the URL [1] produces this error:
Code
Warning: include(pages/projects!/index.php) [function.include]: failed to open stream: No such file or directory in /web/htdocs/www.becrux.com/home/index.php on line 111Hurray! Now, let's try to include an arbitrary file from the filesystem on with the notorious NULL-byte injection [2].
Alas, NULL-byte is escaped and we simply get another error instead of a successful exploitation:
Code
Warning: include(pages/../style/style.css\0/index.php) [function.include]: failed to open stream: No such file or directory in /web/htdocs/www.becrux.com/home/index.php on line 111Now's the time to crack out our filesystem path truncation attack.
We start off with an invalid directory, for example "a/".
Then we add our path traversal, pointing to the file that we want to include like this "../../style/style.css". The first "../" is for our invalid directory, don't forget that.
The path looks like this now: "a/../../style/style.css"
Here comes the exploit.
We add 2027 times the string "/." to the end of the path which will fill up the buffer and get rid of the ".php" at the end.
You end up with an URL like this: [3]
Success, we have included an arbitrary file on the server!
0x03 - Ending words
I hope this tutorial made any sense and / or was of use to anyone reading it. I'd appreciate feedback and corrections on it where applies.
Also, sorry for the bad example, however becrux.com refuses to include /etc/passwd due to a chroot.
* - Error667 - Feb 7, 2012
Will check this, thanks for this mate.
* - QuantumTunnel - Feb 7, 2012
Nice tutorial mate. Thanks for spending the time to create this tutorial much appreciated. :)
* - MajorFail - Feb 7, 2012
Nice tut! Edit: didn't read the tut properly, you already mentioned the 4096 buffer size. But it might be handy to point out that some server have a bigger buffer. :)
* - AntiPaste - Feb 7, 2012
(Feb 7, 2012 01:49 PM)MajorFail Wrote: Nice tut! Edit: didn't read the tut properly, you already mentioned the 4096 buffer size. But it might be handy to point out that some server have a bigger buffer. :)
The default setting is 4096 and it can only be changed during compile time if I remember correctly, not to mention that it's not a well known setting. Thus 99% (100% made up statistic) of the servers have the default buffer of 4096.
* - ƨ e x - Feb 7, 2012
good tut bro, what about etc/passwd ?
* - AntiPaste - Feb 7, 2012
(Feb 7, 2012 02:05 PM)Linuxer Wrote: good tut bro, what about etc/passwd ?
You should be able to figure that out.
Just change the "../../style/style.css" part of the tutorial to "../../../../../../../../../etc/passwd".
I explained why I didn't do that in section 0x03.
* - virus_in_town - Feb 7, 2012
This was great tutorial atleast for me ! it gave me new way to think liked the way you explained thanks alot for this. Keep the good work bro.
* - Das_Virus - Nov 6, 2012
How do you get the path? i mean how do you know that style.css is in ../../style/style.css
Is there any way to list all files?
* - BeggFoMercy - Nov 6, 2012
Impressive work , Well written , keep it up <3
* - 133720 - Nov 6, 2012
Great! POst Dude
I learning advance in LFI
Thanks for tut
* - AntiPaste - Nov 6, 2012
(Nov 6, 2012 03:22 PM)Das_Virus Wrote: How do you get the path? i mean how do you know that style.css is in ../../style/style.css
Is there any way to list all files?
Those are relative paths and I found the location from the site's source code.
The style.css was only an example.
If you can see the full path from the PHP error, it's easier to see how many directories you have to go up to get to the website's root directory.
There's no way to list all the files so you'll have to go guessing, or use files included with almost every copy of the OS.
For example, with Linux /etc/passwd, /proc/self/version etc.
* - chip_worm - Dec 10, 2012
I m too far away to learn this kind of hard attack....
* - Illicit - Dec 10, 2012
Nice tutorial :p Another way to do his would be like this:
http://www.site.com/page.php?page=projects/../../etc/passwd#
Great tutorial though I liked the HEX layout :3
* - AntiPaste - Dec 10, 2012
(Dec 10, 2012 12:52 PM)Red_Hat Wrote: Nice tutorial :p Another way to do his would be like this:
http://www.site.com/page.php?page=projects/../../etc/passwd#
Great tutorial though I liked the HEX layout :3
This was posted more than 10 months ago as you can see. :3
People keep grave digging it though. Thanks anyways. ~
Adding the # at the end of the URL does nothing since most browsers use that as an anchor-tag.
It's not included in the request sent to the server in any way.
You probably meant adding # in it's URL encoded form (%23).
That does nothing for LFI and is most certainly not another way to do what my tutorial explains.