Practice
Local File Inclusion ( also known as LFI ) is the process of including files on the server via a web browser. This vulnerability occurs when a page inclusion is not properly sanitized and allows directory traversal characters to be entered. A typical example of a PHP script vulnerable to LFI looks like this:
<?php
$file = $_GET['file'];
if(isset($file))
{
include("pages/$file");
}
else
{
include("index.php");
}
?>
A legitimate request to the script might look like this:
http://example.com/index.php?file=contactus.php
This is useless to a potential attacker, who is more likely to be interested in files outside the pages/ directory. To do this, the attacker can use LFI. The simplest example would be:
http://example.com/index.php?file=../../../../etc/passwd
On a *nix system this will display the hashes of all passwords on the server, which can subsequently be cracked and used to gain access to files.
Most good administrators will be protected against the simplest LFI attacks, so we need to update the example script accordingly.
<?php
$file = str_replace('../', '', $_GET['file']);
if(isset($file))
{
include("pages/$file");
}
else
{
include("index.php");
}
?>
Now our simple LFI attack will no longer work. Obviously, we don't want this to stop us, so we need to find a way to make our directory traversal work while evading the filters. One way to do this is to encode one or more characters into hexadecimal. This works because the browser decodes the input, but PHP does not. Our new LFI will be:
http://example.com/index.php?file=..%2F..%2F..%2F..%2Fetc%2Fpasswd
LFI attacks are often combined with Poison Null Byte attacks, which help them evade other defenses that may be in place.
Comments