1

I am trying to perform a Path Traversal attack on a very simple web only for educational purposes.

What I have to do is access a file named passwords.txt located in \files\private\admin\passwords.txt, I am on \files\public\ and the URL parameters are the following:

/download.php?folder=&file=&action=download

The path is built concatenating the values of the parameters folder and file to the path \files\public\. None of them are vulnerable to SQL Injection according to SQLMap, neither action. So, if I put:

/download.php?folder=private\admin\&file=passwords.txt&action=download

The resulting path will be \files\public\private\admin\passwords.txt

I have tried the simplest trick like putting \..\ (in plain text and URL encoded form) in order to access the parent folder, but it is not allowed to introduce ...

So, I suppose I have to bypass the security mechanism implemented on the database that injects the path \files\public\ if I want access to that file (DBMS is MySQL).

It is possible to delete the \public\ part of the path using comments with # or another way so I can finally get access to the private directory?

  • What is the SQL that performs the query? You may as well try: ?folder=z;select filename from all_files where filename = '\private\admin\passwords.txt';&action=download – grochmal Dec 23 '16 at 21:32
  • I have no access to the php code, it is a public website. Anyway, the URL parameters are not vulnerable to SQL Injection – user3358218 Dec 23 '16 at 21:41
  • ..\private? That's the simplest path transversal. But, if you are after manual vulnerability discovery then you should read code. If you do not have the code then you should go for fuzzying. – grochmal Dec 23 '16 at 21:45
1

None of them are vulnerable to SQL Injection

Why would they? Is there a reason you expect the download script to perform a query?

You shouldn't rely on tools such as sqlmap. They are meant to make things easier, but if you want to learn - or test an application in-depth -, you need to perform these things yourself.

It is possible to delete the \public\ part of the path using comments with #

No, that doesn't make sense. The path is build like this:

\files\public\[INPUT_PATH]\[INPUT_FILE]

You can't really comment out something that exists before your input (most - if not all - APIs that allow file access also do not allow comments in file path).

or another way so I can finally access to the private directory?

If this is for educational purposed, I'm assuming that it is meant to be vulnerable. You say that "it is not allowed to introduce ..".

Is this an assumption you made? or did you look at the source code and is this actually how it works? If this is a filter, you need to check how it actually works.

  • What if you input ....\\? Maybe the filter replaces ..\ with nothing, which would give you ..\.
  • Is it filtering the file name and the directory? Are the filters the same? Can you use one to travers, but not the other? Can you use / instead of \?
  • can you input . as directory, and .\private\passwords.txt as file? It would combine to \files\public\..\private\passwords.txt
  • I feel so dumb at this moment... You found the right solution only in a few seconds. This issue was driving me crazy, I thought it was more complicated than that. Indeed, I had to put . as directory and the rest of the path in the file parameter. Thank you for your time @tim, I really appreciate it. – user3358218 Dec 23 '16 at 22:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.