Odo Head Spa offered by Odo Beauty Care Limited

Odo Beauty Care Limited Welcome to our first Odo Head Spa Salon located at 9F Pennington Com Bldg., 17 Pennington Street, Causeway Bay (Near to Regal Hotel, Hong Kong and above 7-11) 香港铜锣湾边寧顿亍 17号 边寧顿商业大厅厦电梯 9字 鄰近香港富豪酒店,7-11 樓上 TEL: 9010-1586 English and Japanese only (英/日语) Email: info@odo.com.hk BY APPOINTMENT ONLY 完全予約制 敬请电約

網頁

Powered By Blogger

2024年1月25日星期四

Learning Web Pentesting With DVWA Part 6: File Inclusion

In this article we are going to go through File Inclusion Vulnerability. Wikipedia defines File Inclusion Vulnerability as: "A file inclusion vulnerability is a type of web vulnerability that is most commonly found to affect web applications that rely on a scripting run time. This issue is caused when an application builds a path to executable code using an attacker-controlled variable in a way that allows the attacker to control which file is executed at run time. A file include vulnerability is distinct from a generic directory traversal attack, in that directory traversal is a way of gaining unauthorized file system access, and a file inclusion vulnerability subverts how an application loads code for execution. Successful exploitation of a file inclusion vulnerability will result in remote code execution on the web server that runs the affected web application."
There are two types of File Inclusion Vulnerabilities, LFI (Local File Inclusion) and RFI (Remote File Inclusion). Offensive Security's Metasploit Unleashed guide describes LFI and RFI as:
"LFI vulnerabilities allow an attacker to read (and sometimes execute) files on the victim machine. This can be very dangerous because if the web server is misconfigured and running with high privileges, the attacker may gain access to sensitive information. If the attacker is able to place code on the web server through other means, then they may be able to execute arbitrary commands.
RFI vulnerabilities are easier to exploit but less common. Instead of accessing a file on the local machine, the attacker is able to execute code hosted on their own machine."
In simpler terms LFI allows us to use the web application's execution engine (say php) to execute local files on the web server and RFI allows us to execute remote files, within the context of the target web server, which can be hosted anywhere remotely (given they can be accessed from the network on which web server is running).
To follow along, click on the File Inclusion navigation link of DVWA, you should see a page like this:
Lets start by doing an LFI attack on the web application.
Looking at the URL of the web application we can see a parameter named page which is used to load different php pages on the website.
http://localhost:9000/vulnerabilities/fi/?page=include.php 
Since it is loading different pages we can guess that it is loading local pages from the server and executing them. Lets try to get the famous /etc/passwd file found on every linux, to do that we have to find a way to access it via our LFI. We will start with this:
../etc/passwd 
entering the above payload in the page parameter of the URL:
http://localhost:9000/vulnerabilities/fi/?page=../etc/passwd 
we get nothing back which means the page does not exist. Lets try to understand what we are trying to accomplish. We are asking for a file named passwd in a directory named etc which is one directory up from our current working directory. The etc directory lies at the root (/) of a linux file system. We tried to guess that we are in a directory (say www) which also lies at the root of the file system, that's why we tried to go up by one directory and then move to the etc directory which contains the passwd file. Our next guess will be that maybe we are two directories deeper, so we modify our payload to be like this:
../../etc/passwd 
we get nothing back. We continue to modify our payload thinking we are one more directory deeper.
../../../etc/passwd 
no luck again, lets try one more:
../../../../etc/passwd 
nop nothing, we keep on going one directory deeper until we get seven directories deep and our payload becomes:
../../../../../../../etc/passwd 
which returns the contents of passwd file as seen below:
This just means that we are currently working in a directory which is seven levels deep inside the root (/) directory. It also proves that our LFI is a success. We can also use php filters to get more and more information from the server. For example if we want to get the source code of the web server we can use php wrapper filter for that like this:
php://filter/convert.base64-encode/resource=index.php 
We will get a base64 encoded string. Lets copy that base64 encoded string in a file and save it as index.php.b64 (name can be anything) and then decode it like this:
cat index.php.b64 | base64 -d > index.php 
We will now be able to read the web application's source code. But you maybe thinking why didn't we simply try to get index.php file without using php filter. The reason is because if we try to get a php file with LFI, the php file will be executed by the php interpreter rather than displayed as a text file. As a workaround we first encode it as base64 which the interpreter won't interpret since it is not php and thus will display the text. Next we will try to get a shell. Before php version 5.2, allow_url_include setting was enabled by default however after version 5.2 it was disabled by default. Since the version of php on which our dvwa app is running on is 5.2+ we cannot use the older methods like input wrapper or RFI to get shell on dvwa unless we change the default settings (which I won't). We will use the file upload functionality to get shell. We will upload a reverse shell using the file upload functionality and then access that uploaded reverse shell via LFI.
Lets upload our reverse shell via File Upload functionality and then set up our netcat listener to listen for a connection coming from the server.
nc -lvnp 9999 
Then using our LFI we will execute the uploaded reverse shell by accessing it using this url:
http://localhost:9000/vulnerabilities/fi/?page=../../hackable/uploads/revshell.php 
Voila! We have a shell.
To learn more about File Upload Vulnerability and the reverse shell we have used here read Learning Web Pentesting With DVWA Part 5: Using File Upload to Get Shell. Attackers usually chain multiple vulnerabilities to get as much access as they can. This is a simple example of how multiple vulnerabilities (Unrestricted File Upload + LFI) can be used to scale up attacks. If you are interested in learning more about php wrappers then LFI CheetSheet is a good read and if you want to perform these attacks on the dvwa, then you'll have to enable allow_url_include setting by logging in to the dvwa server. That's it for today have fun.
Leave your questions and queries in the comments below.

References:

  1. FILE INCLUSION VULNERABILITIES: https://www.offensive-security.com/metasploit-unleashed/file-inclusion-vulnerabilities/
  2. php://: https://www.php.net/manual/en/wrappers.php.php
  3. LFI Cheat Sheet: https://highon.coffee/blog/lfi-cheat-sheet/
  4. File inclusion vulnerability: https://en.wikipedia.org/wiki/File_inclusion_vulnerability
  5. PHP 5.2.0 Release Announcement: https://www.php.net/releases/5_2_0.php


More info


  1. Hack Tools
  2. Free Pentest Tools For Windows
  3. Pentest Automation Tools
  4. Hacking Tools For Pc
  5. Pentest Tools Linux
  6. Hack Tool Apk
  7. Hack Apps
  8. Pentest Tools Online
  9. Pentest Tools Download
  10. World No 1 Hacker Software
  11. Termux Hacking Tools 2019
  12. Computer Hacker
  13. Hacking Tools
  14. Hack Tools Online
  15. Hak5 Tools
  16. Hacker Tool Kit
  17. Top Pentest Tools
  18. Hacking Tools
  19. Hacker Techniques Tools And Incident Handling
  20. Hacker Tools Apk Download
  21. Hacker Tools Windows
  22. Android Hack Tools Github
  23. Nsa Hack Tools
  24. Growth Hacker Tools
  25. How To Hack
  26. Ethical Hacker Tools
  27. Growth Hacker Tools
  28. Hacking Tools Name
  29. What Is Hacking Tools
  30. Hacker Tools Linux
  31. Hacker Tools For Windows
  32. Hacker
  33. Pentest Tools Subdomain
  34. Hacking Tools Windows 10
  35. Hacking Tools For Beginners
  36. Physical Pentest Tools
  37. Hacking Tools For Windows 7
  38. Hacker Tools Github
  39. Pentest Reporting Tools
  40. Github Hacking Tools
  41. Hack And Tools
  42. Hacker Tools Hardware
  43. Hacker Tools Linux
  44. Pentest Tools Apk
  45. Hack Tool Apk
  46. Pentest Tools Website Vulnerability
  47. Hack Apps
  48. Hacker Tools Apk Download
  49. Hacker Tools Hardware
  50. Hacker Tools 2019
  51. Top Pentest Tools
  52. Hacker
  53. Hacker Tools For Pc
  54. Hacker Tools For Mac
  55. What Are Hacking Tools
  56. Hack Tools
  57. Pentest Tools Kali Linux
  58. Hacker Tools Windows
  59. Pentest Tools Kali Linux
  60. Hacker Tools Online
  61. Hacking Tools Mac
  62. Hacker Tools Free Download
  63. Hacking Tools Free Download
  64. Hacking Tools Online
  65. Hacking Tools For Windows Free Download
  66. Hacking Tools For Kali Linux
  67. Free Pentest Tools For Windows
  68. Hacking Tools For Pc
  69. Hack Tool Apk
  70. New Hack Tools
  71. Hacking Tools Windows 10
  72. Hacking Tools Pc
  73. Hacking Tools Online
  74. Hack Tools Github
  75. Pentest Recon Tools
  76. Nsa Hacker Tools
  77. Hacker Tools For Pc
  78. Hackrf Tools
  79. Pentest Tools Tcp Port Scanner
  80. Hacking Tools Github
  81. Hacker Tools Linux
  82. Hacker Tools For Windows
  83. Hack Tools Online
  84. Hacker Tools Mac
  85. Hacking Tools 2019
  86. Hacker Tools For Ios
  87. Hacker Tools Free Download
  88. What Is Hacking Tools
  89. Pentest Tools
  90. Hacker Tools Mac
  91. Black Hat Hacker Tools
  92. Hacking Tools Pc
  93. Hacker Tools Software
  94. Hacking Tools For Beginners
  95. How To Install Pentest Tools In Ubuntu
  96. Hacking Tools For Games
  97. Hacking Tools 2019
  98. Kik Hack Tools
  99. Hacker
  100. Hack Tools
  101. Top Pentest Tools
  102. Pentest Box Tools Download
  103. Hacking Tools For Games
  104. Easy Hack Tools
  105. Hacking Tools
  106. Hack Tools Download
  107. Hack Tools For Pc
  108. Hacking Tools Software
  109. Hack Tools
  110. Pentest Tools Github
  111. Hack Tools Download
  112. Hack Tools 2019
  113. Hacking Tools Mac
  114. Hak5 Tools
  115. Github Hacking Tools
  116. Pentest Tools Windows
  117. Hak5 Tools
  118. Hack App
  119. Pentest Box Tools Download
  120. Hacker Tools Free Download
  121. Hack Tools
  122. Hacking App
  123. Nsa Hack Tools
  124. Hacking Tools Name
  125. Hacking Tools
  126. Pentest Recon Tools
  127. Pentest Automation Tools
  128. Hack Tools
  129. Pentest Tools Subdomain
  130. Hacking App
  131. Hacker Tools Windows
  132. Hack Tools Online
  133. Tools 4 Hack
  134. Hacking Tools For Kali Linux
  135. Hack Tools For Mac
  136. Hacker Tools List
  137. Pentest Tools For Mac
  138. Hack Rom Tools
  139. Pentest Tools Linux
  140. Pentest Tools Free
  141. Hacker Tools For Pc
  142. Hacker Tools For Mac
  143. Hack Rom Tools
  144. Hacker Tools Free Download
  145. Hack Tool Apk No Root
  146. Tools For Hacker
  147. Hacker Tools Apk
  148. Underground Hacker Sites
  149. World No 1 Hacker Software
  150. Hacking Tools For Windows
  151. Pentest Tools Port Scanner
  152. Pentest Tools Free
  153. How To Install Pentest Tools In Ubuntu
  154. Best Pentesting Tools 2018
  155. Hacker Tools For Windows
  156. Pentest Tools Review
  157. Black Hat Hacker Tools
  158. Pentest Box Tools Download
  159. Hacking Tools
  160. Pentest Box Tools Download
  161. Wifi Hacker Tools For Windows
  162. Hackers Toolbox
  163. Pentest Tools For Android
  164. Pentest Tools Subdomain
  165. Hacker Tool Kit
  166. Hacker Tools Free Download
  167. Pentest Tools Website Vulnerability
  168. Hacker Tools Linux

沒有留言:

發佈留言