Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -4 down vote favorite

I found a vulnerability in a site that can allow the download of any file of the server. I tested it by succesfully downloading boot.ini and autoexec.bat.

I have no access to source code or file system structures. All I know is it runs Win 2003 Server Ent. in drive C:, Oracle 10.1.2 AS_1 in drive F:.

I would like to know what files can be downloaded in order to compromise it? (I dont have the intention of doing aything wrong in this server, just want to know how vulnerable it is.)

I suspect that I can use this vulnerability to escalate to shell access, or at least write access of some kind. Are there files containing credentials that may be used for a remote login, for example? What files should I try downloading next?

(Conversely, these are the files that the administrator must take care to protect. If you were the system administrator, which files' permissions would you double check before declaring the server ready to go live?)

share|improve this question
I'm confused. Do you mean download (getting files from the server) or upload (sending files to the server)? – Iszi Aug 15 '12 at 16:56
I mean getting files from the server – async3 Aug 15 '12 at 17:09
@ponsfonze Yes, but you can't compromise a server by downloading files. You can use the information gathered from downloads to plan your attack, but downloading in and of itself will not do anything to the system. The worst you might try to do is DoS it by running a whole lot of concurrent downloads. Downloading is effectively useless to compromise a system except as a means of information gathering. – Iszi Aug 15 '12 at 17:10
Uploading files, on the other hand, can do quite a bit of damage if you have access to write to certain areas of the system and/or overwrite critical system files. – Iszi Aug 15 '12 at 17:18
So, can you clarify whether you have downloaded those two files from the server, or uploaded to them. @Iszi's previous 2 comments are your answers to those two cases. – Rory Alsop♦ Aug 15 '12 at 17:21
show 5 more comments

closed as too localized by dr jimbob, Scott Pack, Iszi, Rory Alsop♦ Aug 15 '12 at 17:46

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, see the FAQ.

1 Answer

up vote 3 down vote

You already have your answer. It is very vulnerable to LFI because someone can download system files. You have already compromised the system.

You can use brute-force techniques to map out the file structure.

If, instead, you want shell access, then you need to download configuration files to determine what services might be running and how they are configured, then log in using those services. Or else find a way to upload a shell to the server.

Oh, and I call "blackhat" ....

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.