/usr/share/w3af/plugins/audit/localFileInclude.py is in w3af-console 1.1svn5547-1.1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 | '''
localFileInclude.py
Copyright 2006 Andres Riancho
This file is part of w3af, w3af.sourceforge.net .
w3af is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation version 2 of the License.
w3af is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with w3af; if not, write to the Free Software
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
'''
from __future__ import with_statement
import core.controllers.outputManager as om
# options
from core.data.options.option import option
from core.data.options.optionList import optionList
from core.controllers.basePlugin.baseAuditPlugin import baseAuditPlugin
from core.controllers.misc.is_source_file import is_source_file
import core.data.kb.knowledgeBase as kb
import core.data.kb.vuln as vuln
import core.data.kb.info as info
import core.data.constants.severity as severity
import core.data.kb.config as cf
from core.data.fuzzer.fuzzer import createMutants
from core.data.esmre.multi_in import multi_in
import re
class localFileInclude(baseAuditPlugin):
'''
Find local file inclusion vulnerabilities.
@author: Andres Riancho ( andres.riancho@gmail.com )
'''
FILE_PATTERNS = (
"root:x:0:0:",
"daemon:x:1:1:",
":/bin/bash",
":/bin/sh",
# /etc/passwd in AIX
"root:!:x:0:0:",
"daemon:!:x:1:1:",
":usr/bin/ksh",
# boot.ini
"[boot loader]",
"default=multi(",
"[operating systems]",
# win.ini
"[fonts]",
)
_multi_in = multi_in( FILE_PATTERNS )
def __init__(self):
baseAuditPlugin.__init__(self)
# Internal variables
self._file_compiled_regex = []
self._error_compiled_regex = []
self._open_basedir = False
def audit(self, freq ):
'''
Tests an URL for local file inclusion vulnerabilities.
@param freq: A fuzzableRequest
'''
om.out.debug( 'localFileInclude plugin is testing: ' + freq.getURL() )
oResponse = self._uri_opener.send_mutant(freq)
# What payloads do I want to send to the remote end?
local_files = []
local_files.append( freq.getURL().getFileName() )
if not self._open_basedir:
local_files.extend( self._get_local_file_list(freq.getURL()) )
mutants = createMutants( freq , local_files, oResponse=oResponse )
for mutant in mutants:
# Only spawn a thread if the mutant has a modified variable
# that has no reported bugs in the kb
if self._has_no_bug(mutant):
# I don't grep the result, because if I really find a local
# file inclusion I will be requesting /etc/passwd and that
# would generate A LOT of false positives in the
# grep.pathDisclosure plugin
args = (mutant,)
kwds = {'callback': self._analyze_result,
'grep': False }
self._run_async(meth=self._uri_opener.send_mutant, args=args,
kwds=kwds)
self._join()
def _get_local_file_list( self, origUrl):
'''
This method returns a list of local files to try to include.
@return: A string list, see above.
'''
local_files = []
extension = origUrl.getExtension()
# I will only try to open these files, they are easy to identify of they
# echoed by a vulnerable web app and they are on all unix or windows default installs.
# Feel free to mail me ( Andres Riancho ) if you know about other default files that
# could be installed on AIX ? Solaris ? and are not /etc/passwd
if cf.cf.getData('targetOS') in ['unix', 'unknown']:
local_files.append("../" * 15 + "etc/passwd")
local_files.append("../" * 15 + "etc/passwd\0")
local_files.append("../" * 15 + "etc/passwd\0.html")
local_files.append("/etc/passwd")
# This test adds support for finding vulnerabilities like this one
# http://website/zen-cart/extras/curltest.php?url=file:///etc/passwd
#local_files.append("file:///etc/passwd")
local_files.append("/etc/passwd\0")
local_files.append("/etc/passwd\0.html")
if extension != '':
local_files.append("/etc/passwd%00."+ extension)
local_files.append("../" * 15 + "etc/passwd%00."+ extension)
if cf.cf.getData('targetOS') in ['windows', 'unknown']:
local_files.append("../" * 15 + "boot.ini\0")
local_files.append("../" * 15 + "boot.ini\0.html")
local_files.append("C:\\boot.ini")
local_files.append("C:\\boot.ini\0")
local_files.append("C:\\boot.ini\0.html")
local_files.append("%SYSTEMROOT%\\win.ini")
local_files.append("%SYSTEMROOT%\\win.ini\0")
local_files.append("%SYSTEMROOT%\\win.ini\0.html")
if extension != '':
local_files.append("C:\\boot.ini%00."+extension)
local_files.append("%SYSTEMROOT%\\win.ini%00."+extension)
return local_files
def _analyze_result( self, mutant, response ):
'''
Analyze results of the _send_mutant method.
Try to find the local file inclusions.
'''
with self._plugin_lock:
#
# I analyze the response searching for a specific PHP error string that tells me
# that open_basedir is enabled, and our request triggered the restriction. If
# open_basedir is in use, it makes no sense to keep trying to read "/etc/passwd",
# that is why this variable is used to determine which tests to send if it was possible
# to detect the usage of this security feature.
#
if not self._open_basedir:
if 'open_basedir restriction in effect' in response\
and 'open_basedir restriction in effect' not in mutant.getOriginalResponseBody():
self._open_basedir = True
#
# I will only report the vulnerability once.
#
if self._has_no_bug(mutant):
#
# Identify the vulnerability
#
file_content_list = self._find_file(response)
for file_pattern_match in file_content_list:
if file_pattern_match not in mutant.getOriginalResponseBody():
v = vuln.vuln(mutant)
v.setPluginName(self.getName())
v.setId(response.id)
v.setName('Local file inclusion vulnerability')
v.setSeverity(severity.MEDIUM)
v.setDesc('Local File Inclusion was found at: ' + mutant.foundAt())
v['file_pattern'] = file_pattern_match
v.addToHighlight(file_pattern_match)
kb.kb.append(self, 'localFileInclude', v)
return
#
# If the vulnerability could not be identified by matching strings that commonly
# appear in "/etc/passwd", then I'll check one more thing...
# (note that this is run if no vulns were identified)
#
# http://host.tld/show_user.php?id=show_user.php
if mutant.getModValue() == mutant.getURL().getFileName():
match, lang = is_source_file( response.getBody() )
if match:
# We were able to read the source code of the file that is vulnerable to
# local file read
v = vuln.vuln( mutant )
v.setPluginName(self.getName())
v.setId( response.id )
v.setName( 'Local file read vulnerability' )
v.setSeverity(severity.MEDIUM)
msg = 'An arbitrary local file read vulnerability was found at: '
msg += mutant.foundAt()
v.setDesc( msg )
#
# Set which part of the source code to match
#
match_source_code = match.group(0)
v['file_pattern'] = match_source_code
kb.kb.append( self, 'localFileInclude', v )
return
#
# Check for interesting errors (note that this is run if no vulns were identified)
#
for regex in self.get_include_errors():
match = regex.search( response.getBody() )
if match and not \
regex.search( mutant.getOriginalResponseBody() ):
i = info.info( mutant )
i.setPluginName(self.getName())
i.setId( response.id )
i.setName( 'File read error' )
i.setDesc( 'A file read error was found at: ' + mutant.foundAt() )
kb.kb.append( self, 'error', i )
def end(self):
'''
This method is called when the plugin wont be used anymore.
'''
self._join()
self.printUniq(kb.kb.getData('localFileInclude', 'localFileInclude'), 'VAR')
self.printUniq(kb.kb.getData('localFileInclude', 'error'), 'VAR')
def getOptions( self ):
'''
@return: A list of option objects for this plugin.
'''
ol = optionList()
return ol
def setOptions( self, OptionList ):
'''
This method sets all the options that are configured using the user interface
generated by the framework using the result of getOptions().
@parameter OptionList: A dictionary with the options for the plugin.
@return: No value is returned.
'''
pass
def _find_file( self, response ):
'''
This method finds out if the local file has been successfully included in
the resulting HTML.
@parameter response: The HTTP response object
@return: A list of errors found on the page
'''
res = []
for file_pattern_match in self._multi_in.query( response.getBody() ):
res.append( file_pattern_match )
if len(res) == 1:
msg = 'A file fragment was found. The section where the file is included is (only'
msg += ' a fragment is shown): "' + res[0]
msg += '". This is just an informational message, which might be related to a'
msg += ' vulnerability and was found on response with id ' + str(response.id) + '.'
om.out.debug( msg )
if len(res) > 1:
msg = 'File fragments have been found. The following is a list of file fragments'
msg += ' that were returned by the web application while testing for local file'
msg += ' inclusion: \n'
for file_pattern_match in res:
msg += '- "' + file_pattern_match + '" \n'
msg += 'This is just an informational message, which might be related to a'
msg += ' vulnerability and was found on response with id ' + str(response.id) + '.'
om.out.debug( msg )
return res
def get_include_errors(self):
'''
@return: A list of file inclusion / file read errors generated by the web application.
'''
#
# In previous versions of the plugin the "Inclusion errors" listed in the _get_file_patterns
# method made sense... but... it seems that they trigger false positives...
# So I moved them here and report them as something "interesting" if the actual file
# inclusion is not possible
#
if self._error_compiled_regex:
return self._error_compiled_regex
else:
read_errors = []
read_errors.append("java.io.FileNotFoundException:")
read_errors.append("fread\\(\\):")
read_errors.append("for inclusion '\\(include_path=")
read_errors.append("Failed opening required")
read_errors.append("<b>Warning</b>: file\\(")
read_errors.append("<b>Warning</b>: file_get_contents\\(")
self._error_compiled_regex = [re.compile(i, re.IGNORECASE) for i in read_errors]
return self._error_compiled_regex
def getPluginDeps( self ):
'''
@return: A list with the names of the plugins that should be run before the
current one.
'''
return []
def getLongDesc( self ):
'''
@return: A DETAILED description of the plugin functions and features.
'''
return '''
This plugin will find local file include vulnerabilities. This is done by sending to all injectable parameters
file paths like "../../../../../etc/passwd" and searching in the response for strings like "root:x:0:0:".
'''
|