2

I have setup a test application in Linux. I havent checked for paths in it, so if user enter /etc/passwd , then that file gets displayed to him.

However, I want to understand what more can be done if my website is prone to path traversal attack. How can someone get root access ? If at all, its possible if vulnerability for path traversal exists.

Improve this question

3 Answers 3

Reset to default
8

The question you're effectively asking is what are the dangers of allowing every file on my server to be readable by anyone?

This has a few serious implications, the attacker could:

  1. View stored passwords - if, for example, you run wordpress the attacker could easily gain access to your username and password for your database server (e.g. wp-config.php)
  2. Gain information that could be used in further attacks - /etc/passwd may only contain usernames but that could be enough to start a brute force attack. Log files could also be read giving addresses of the user. Encrypted password files could be bruteforced offline.
  3. Read private information - if your website consists intellectual property (i.e. source code, e-mails) this could be easily read by the attacker.

Basically whilst your attacker hasn't technically gained root access they have gained access to a wealth of data. This data could either be used in other attacks or (depending upon the aims of the attacker) could be enough.

There are almost certainly situations there where this vulnerability would be as bad as the attacker gaining root access. The security priority for a server may be for it to not reveal the system's source code, if this vulnerability were present then for those cases the worst possible attack has occurred.

Improve this answer
5

In addition to good answers from others:

If the attacker can read every file on your system, they can download /root/.ssh/id_dsa, /home/user/.ssh/id_dsa (for each user; you can get the list of usernames from /etc/password). This will let them learn the SSH private keys for all of the users on the system. They can also download /etc/ssh/ssh_host_key, which lets them learn the system's host SSH private key. All of this is very bad.

Improve this answer
2
  • 1
    Overlooked this one. Plus the attacker can look at the known_hosts file to see which servers have been accessed with a particular user and either use that users private key that they've stolen or the password that they cracked from /etc/shadow to access these other remote systems.
    – Safado
    Commented May 8, 2012 at 19:03
  • @D.W. : Great point !
    – Novice User
    Commented May 9, 2012 at 2:37
4

I hope I'm understanding your question correctly. Assuming that they have the ability to read /etc/passwd, they now have a list of user names they can try and brute force the server with. If the attacker is able to read /etc/shadow, they'll then have the password hashes for all the users. With the hashes, they could then run it through an extremely fast password cracker. There is also the possibility that they could pull up configuration files for your firewall and see if you allow special access for certain IPs or Mac address. They could pull up web application config files (i.e. Wordpress or MediaWiki or whatever you have running) that may have passwords stored in configuration files. If you're running a website that has a handle file that stores database credentials, they could retrieve that. There is a lot a hacker could do if they can read all the files on your server.

Improve this answer
3
  • Even if /etc/shadow is visible, Lets assume he is able to retrieve the password, but how can he login to the server, when the Server can only be accessed inside VPN ?
    – Novice User
    Commented May 8, 2012 at 17:13
  • If the server is only accessible from the VPN, isn't it safe to assume then that if the attacker is gathering this information he's in the VPN as well?
    – Safado
    Commented May 8, 2012 at 19:01
  • M : I'm assuming that the website is vulnerable in public domain, like xxxx.com/index.php?file=/etc/passwd , now the bad guy really needs to be part of the VPN to exploit the system to the fullest. Am I getting anything wrong ?
    – Novice User
    Commented May 9, 2012 at 2:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .