4

I've been thinking about expanding what I could do with an LFI attack to somehow extract information that we usually get by invoking commands. And since a lot of things in Linux behave like a file or at least streams of bytes, I thought I could get almost any info I want.

I have success reading /proc/* and configuration files /home/user/.* but can't seem to get anything on my network information IP, gateway etc. Tried strace-ing /bin/ifconfig but they seem to read .so files.

So, is there any way of achieving this through LFI? I'm testing this on a Debian machine but I'm just curious about the possibility in general regardless of platform.

To clarify, The LFI exploit I'm testing this on is technically an arbitrary file download vulnerability where the response MIME type is image/php so you can safely download a binary file. Didn't think this changes anything though unless I can derive the information I need by scraping some binary file's content.

Improve this question

2 Answers 2

Reset to default
1

There are various files that can provide networking information on Linux-based systems.

/etc/hosts may provide information on internal/overwritten DNS routes.

/etc/networks could provide information on symbolic network names.

/etc/sysconfig/network-scripts/ifcfg-* where * is e.g. eth0 may provide information concerning specific network interfaces.

Then there are various other resources that could spill information. Think about access logs of the web server used, web server configuration files, the user's .bash_history containing past commands, possibly with network parameters. These are dependent on the specific software used on the server and harder to generalize.

Improve this answer
0
1

In /proc/net/ there are a number of files with useful info:

  • /proc/net/fib_trie - IPv4 adresses
  • /proc/net/if_inet6 - IPv6 addresses
  • /proc/net/route - IPv4 routing tables
  • /proc/net/ipv6_route - IPv6 routing tables

However, you may need to put some effort into translating the output into something useful, since most of the output is not that user friendly.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .