Local File Inclusion [ Post-Exploitation ]

Question

I am curious what kind of sensitive files should I look for on a Windows server which is vulnerable to LFI compared to Linux?

I mean the first file or common files which a pentester or an unauthorized user will go for?

I am looking for possible post-exploitation ways for LFI vulnerability for a website that is hosted on a Windows server instead of Linux.

I know I can upload backdoors and reverse shell connections etc. But, I am more interested in other possibilities instead of these.

Since this is an assignment I have assigned with. So during presentation, I won't be going that deep into web shells and using Kali Linux etc.

Just want to cover a simple and general post-exploitation for LFI without using external backdoors or tools

Answer 1

This may depend on what files the webserver's user may have access to. But, this user should at least have access to the files related to the webserver. This could include viewing application source code (to help find additional, more severe issues like RCE), configuration files (possibly containing sensitive information such as database credentials which could be used by an attacker if the database server is exposed), or other files (think user uploads).

As far as general Windows files, I found a cheat sheet for Windows LFI online: https://www.gracefulsecurity.com/path-traversal-cheat-sheet-windows/

C:/Users/Administrator/NTUser.dat
C:/Documents and Settings/Administrator/NTUser.dat
C:/apache/logs/access.log 
C:/apache/logs/error.log 
C:/apache/php/php.ini 
C:/boot.ini 
C:/inetpub/wwwroot/global.asa 
C:/MySQL/data/hostname.err 
C:/MySQL/data/mysql.err 
C:/MySQL/data/mysql.log 
C:/MySQL/my.cnf 
C:/MySQL/my.ini 
C:/php4/php.ini 
C:/php5/php.ini 
C:/php/php.ini 
C:/Program Files/Apache Group/Apache2/conf/httpd.conf 
C:/Program Files/Apache Group/Apache/conf/httpd.conf 
C:/Program Files/Apache Group/Apache/logs/access.log 
C:/Program Files/Apache Group/Apache/logs/error.log 
C:/Program Files/FileZilla Server/FileZilla Server.xml 
C:/Program Files/MySQL/data/hostname.err 
C:/Program Files/MySQL/data/mysql-bin.log 
C:/Program Files/MySQL/data/mysql.err 
C:/Program Files/MySQL/data/mysql.log 
C:/Program Files/MySQL/my.ini 
C:/Program Files/MySQL/my.cnf 
C:/Program Files/MySQL/MySQL Server 5.0/data/hostname.err 
C:/Program Files/MySQL/MySQL Server 5.0/data/mysql-bin.log 
C:/Program Files/MySQL/MySQL Server 5.0/data/mysql.err 
C:/Program Files/MySQL/MySQL Server 5.0/data/mysql.log 
C:/Program Files/MySQL/MySQL Server 5.0/my.cnf 
C:/Program Files/MySQL/MySQL Server 5.0/my.ini 
C:/Program Files (x86)/Apache Group/Apache2/conf/httpd.conf 
C:/Program Files (x86)/Apache Group/Apache/conf/httpd.conf 
C:/Program Files (x86)/Apache Group/Apache/conf/access.log 
C:/Program Files (x86)/Apache Group/Apache/conf/error.log 
C:/Program Files (x86)/FileZilla Server/FileZilla Server.xml 
C:/Program Files (x86)/xampp/apache/conf/httpd.conf 
C:/WINDOWS/php.ini 
C:/WINDOWS/Repair/SAM 
C:/Windows/repair/system 
C:/Windows/repair/software  
C:/Windows/repair/security 
C:/WINDOWS/System32/drivers/etc/hosts 
C:/Windows/win.ini 
C:/WINNT/php.ini 
C:/WINNT/win.ini  
C:/xampp/apache/bin/php.ini 
C:/xampp/apache/logs/access.log  
C:/xampp/apache/logs/error.log 
C:/Windows/Panther/Unattend/Unattended.xml 
C:/Windows/Panther/Unattended.xml 
C:/Windows/debug/NetSetup.log 
C:/Windows/system32/config/AppEvent.Evt 
C:/Windows/system32/config/SecEvent.Evt 
C:/Windows/system32/config/default.sav 
C:/Windows/system32/config/security.sav 
C:/Windows/system32/config/software.sav 
C:/Windows/system32/config/system.sav 
C:/Windows/system32/config/regback/default 
C:/Windows/system32/config/regback/sam 
C:/Windows/system32/config/regback/security
C:/Windows/system32/config/regback/system 
C:/Windows/system32/config/regback/software 
C:/Program Files/MySQL/MySQL Server 5.1/my.ini 
C:/Windows/System32/inetsrv/config/schema/ASPNET_schema.xml 
C:/Windows/System32/inetsrv/config/applicationHost.config 
C:/inetpub/logs/LogFiles/W3SVC1/u_ex[YYMMDD].log

Some of these should be world readable; others may be locked down or non-existent. These should provide a good starting point, but there may be additional files you should add depending on what you are looking for.

Answer 2

Apart from multithr3at3d's answer, there is a blog post which exactly tries to answer this: https://medium.com/@hakluke/sensitive-files-to-grab-in-windows-4b8f0a655f40

%windir%\repair\sam
%windir%\System32\config\RegBack\SAM
%windir%\repair\system
%windir%\repair\software
%windir%\repair\security
%windir%\debug\NetSetup.log (AD domain name, DC name, internal IP, DA account)
%windir%\iis6.log (5,6 or 7)
%windir%\system32\logfiles\httperr\httperr1.log
C:\sysprep.inf
C:\sysprep\sysprep.inf
C:\sysprep\sysprep.xml
%windir%\Panther\Unattended.xml
C:\inetpub\wwwroot\Web.config
%windir%\system32\config\AppEvent.Evt (Application log)
%windir%\system32\config\SecEvent.Evt (Security log)
%windir%\system32\config\default.sav
%windir%\system32\config\security.sav
%windir%\system32\config\software.sav
%windir%\system32\config\system.sav
%windir%\system32\inetsrv\config\applicationHost.config
%windir%\system32\inetsrv\config\schema\ASPNET_schema.xml
%windir%\System32\drivers\etc\hosts (dns entries)
%windir%\System32\drivers\etc\networks (network settings)
%windir%\system32\config\SAM (only really useful if you have access to the files while the machine is off)