![]() |
|
[TUT][LFI] ~ Local File Inclusion to shell access [TUT] - Printable Version +- Hack Forums (https://hackforums.net) +-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45) +--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449) +---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43) +---- Thread: [TUT][LFI] ~ Local File Inclusion to shell access [TUT] (/showthread.php?tid=4030593) |
[TUT][LFI] ~ Local File Inclusion to shell access [TUT] - Im gone brah - Jan 30, 2014 Local File Inclusion Note: This tutorial is not new. Just an update of my old one. So listen to something while reading. Requirements
etc/passwd file stores essential information, which is required during login i.e. user account information. /etc/passwd is a text file, that contains a list of the system's accounts, giving for each account some useful information like user ID, group ID, home directory, shell, etc. It should have general read permission as many utilities, like ls use it to map user IDs to user names, but write access only for the superuser (root). source First of all we're going to find that file and hopefully we have privligies to view it. Default /etc/passwd permissions is 644. 644 means that ONLY the owner of it has privligies to write, while others can ONLY read. PHP Code PHP Code If it works a document will show up, similiar to this one. Code root@dogmeister:~# cat /etc/passwdRemember that you will not have privilgies to display this file every time. You may as well need to move to another directory. PHP Code PHP Code PHP Code Display the /proc/self/environ file. Most of the times you can just keep the current path and switch out the etc/passwd with proc/self/environ Just like I am doing here. PHP Code PHP Code Example of the /proc/self/environ file Code root@dogmeister:~# cat /proc/self/environLaunch up Tamper Data. ![]() Now start tampering and only refresh the target website. You can do so by pressing F5. ![]() A tamper request will show up and ask you if you want to Tamper or Submit or Abort the Request. Press Tamper and the addon will start tampering the website and after a while a box will show up, similar to this one. ![]() Remove all the text in the User-agent field and put on this php code. PHP Code The site you're trying to hack will now include the php code you injected. Basically the site will load the PHP function phpinfo() and render the information in HTML. [img]http://gemsres.com/story/mar06/200299/fig01.gif[/img] Do the same process again with another chunk of code. PHP Code However, if everything went smooth you shall now be able to access your shell in the folder you uploaded it to. /tmp/ is a good place to spawn a shell, since it's almost always writeable. WEBSITE APPLICATION FIREWALL BYPASS Instead of using /etc/passwd you would change every '/' to'%2f' without quotes. (/=%2f) That's a pretty easy form to remember, keep that in mind. So the new will be: PHP Code To bypass the character limit, you could just put in a few more ./././ after the vector and the output would look like this: PHP Code The infamous null bytes method is probably the easiest of them all. Simply add this to the end of the url. PHP Code PHP Code * - ------------ - Jan 30, 2014 Thanks for this, worth the read mate! * - Ch1m4zz - Jan 30, 2014 I guess this can come in handy but still I really think it's hard to find a site vuln to LFI .. :( * - VipVince - Jan 30, 2014 (Jan 30, 2014 11:02 AM)Ch1m4zz Wrote: I guess this can come in handy but still I really think it's hard to find a site vuln to LFI .. :( Really? I have always found them semi common. * - Impress. - Jan 31, 2014 Nice tutorial Zayne :) we should talk again on skype or so :P -Media |