Local File Inclusion (LFI) vulnerabilities are a significant security risk in web applications that fail to properly validate user-supplied input, allowing attackers to include files from the local system. These vulnerabilities can lead to severe security breaches, such as unauthorized access to sensitive files, remote code execution, and system compromise. In this article, we will discuss LFI vulnerabilities in detail and demonstrate how to test and exploit such vulnerabilities using a DVWA (Damn Vulnerable Web Application) lab hosted on Metasploitable2.
What is Local File Inclusion (LFI)?
Local File Inclusion is a type of vulnerability that allows attackers to include files from the local filesystem into a web application. It typically occurs when a web application allows a user to specify a file path that the application subsequently includes and displays. If the input is not properly sanitized, malicious users can manipulate the file path to access files outside the intended directory, often gaining access to critical system files such as /etc/passwd, which stores user information on Unix-based systems.
LFI vulnerabilities are particularly dangerous because they can lead to various forms of attack, including:
- Information Disclosure: Attackers can access sensitive files like configuration files or system logs.
- Remote Code Execution: If an attacker can include files that contain malicious code, they may execute arbitrary commands on the server.
- Privilege Escalation: Accessing critical files or system information could allow attackers to escalate their privileges on the server.
Setting Up the Testing Environment
To demonstrate how LFI works and how it can be exploited, we will use the DVWA (Damn Vulnerable Web Application) hosted on Metasploitable2. DVWA is an intentionally vulnerable web application designed for security testing and learning purposes. Metasploitable2 is a vulnerable virtual machine used to simulate real-world security issues.
- Accessing DVWA: Start by navigating to the DVWA login page hosted on the Metasploitable2 virtual machine. In this case, the DVWA lab can be accessed through the URL:
http://192.168.148.139/dvwa/login.php. - Logging In: Once logged in with valid credentials, set the security level of the DVWA application to low to make it easier to exploit vulnerabilities for testing purposes.
- Accessing the File Inclusion Vulnerability: After setting the security level, navigate to the File Inclusion button located on the left sidebar of the DVWA interface. This will direct you to the vulnerable page:
http://192.168.148.139/dvwa/vulnerabilities/fi/?page=include.php.
How Local File Inclusion Works
The key element in an LFI vulnerability is the page parameter used in the URL. The page parameter is designed to specify which file to include in the web page’s output. For example:
http://192.168.148.139/dvwa/vulnerabilities/fi/?page=include.php
Here, the include.php file is included in the output of the application. However, if the application does not properly sanitize user input, an attacker could manipulate the page parameter to include files from other locations on the server.
Exploiting LFI with Directory Traversal
In our case, we can exploit the LFI vulnerability by using directory traversal characters (../) in the page parameter. These characters allow us to move up the directory structure and access files located outside the root directory of the web application.
The payload for this attack is:
../../../../../etc/passwdThis payload attempts to traverse up the directory structure (moving up five levels) and access the /etc/passwd file, which contains user account information on Unix-based systems. The resulting URL would be:
http://192.168.148.139/dvwa/vulnerabilities/fi/?page=../../../../../etc/passwd
When this URL is accessed, the application will attempt to include the passwd file from the /etc directory, which is outside the web application’s root folder. If the application does not sanitize the input, the file will be included, and its contents will be displayed on the page.
What Happens When LFI is Exploited?
In this case, accessing the /etc/passwd file allows us to view sensitive information about user accounts on the system. The contents of the passwd file might look like this:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...This file contains user details, including usernames, user IDs, group IDs, home directories, and shell information. While /etc/passwd itself does not contain passwords (they are stored in /etc/shadow), this file can still provide valuable information for attackers attempting to escalate privileges or gain unauthorized access.
Mitigation Techniques
To prevent LFI vulnerabilities, web developers should implement proper input validation and file inclusion restrictions. Here are some key mitigation strategies:
- Validate User Input: Always sanitize and validate user input, especially when it is used to access files. Avoid directly using user-supplied data in file paths.
- Use Absolute Paths: Avoid using relative paths in file inclusion functions. Use absolute paths to ensure files are only included from trusted locations.
- Disable URL Parameters for File Inclusion: If file inclusion is not required for the application, it is best to disable or restrict access to the functionality that uses the
pageparameter. - Web Application Firewalls (WAFs): Use WAFs to block common malicious payloads and requests associated with LFI attacks.
Conclusion
Local File Inclusion (LFI) vulnerabilities pose a serious risk to web applications and can lead to information disclosure, system compromise, and remote code execution. In this article, we demonstrated how LFI can be tested and exploited using the DVWA lab on Metasploitable2. By using directory traversal and manipulating the page parameter, we were able to access sensitive files like /etc/passwd.
It is crucial for developers to secure their web applications by validating user input and implementing safeguards against LFI vulnerabilities.
