I've got an application vulnerable to directory traversal (I know this because it's part of the wording of the question). The application has two directories, public and private, and two php files:
A.php?folder=[public|private]list the content of both directories.
B.php?folder=public&file=test.txt&action=[view|download]view or download the specified file.
I need to view a file called
users.txt which is allocated in the private directory.
B.phpseems to have a restriction that only allows the action on the public directory, so if I type
B.php?folder=private&file=users.txt&action=view, actually it's trying to read
\public\private\admin\users.txt (notice the backslash, it's a Windows system if that matters).
My next step was to jump back in the directory tree, but neither
%2E%2E are allowed by the application. It returns a message saying that the dot char can't be used for the folder or the file.
There is no cookies nor POST data.
So, how could I "break the jail" of the public directory in B.php? Any ideas?
PS: spoke with my instructor and he confirms this is a tricky question.