I have found a path traversal vulnerability that allows me to read any path on the server that does not require
To fully exploit this, I would like to know which files exist in each directory so I can read them.
In other words, I can do
cat /any/path, but not
ls /any/path nor
sudo cat /any/path. So how can I find as many files as possible to
cat them (without trying all possibilities...)
Reading special files like dev or proc, or files present on most Linux distributions is OK. For example, if I could read
/var/lib/mlocate/mlocate.db database the problem would be solved: but I can't because I don't have
If there is no ideal answer that lists all files, I am also interested in answers that list large number of existing files.
In this particular instance, the traversal happens inside a remote VM, so privilege escalation in itself is not the main goal: what I'm interested in is confidential source code that may be found on the VM. But very common privilege escalation paths are also welcome as those would give us
mlocate and solve the problem, besides being directly useful in other systems.
More precisely, the system in my case is a build on push Git service analogous to GitHub / GH pages (assuming each Jekyll build runs on VM, which I don't know). Mentioning this because it has already been fixed by vendors of course :) It is me who creates the Git repo: that is the attack vector, so reading the Git repository is not very interesting.