Directory Traversals

Hi everyone and Welcome to this New Video in this video I continue My Series on web exploitation and in particular We will talk about Directory traversal I hope the video is enjoyable If you have any feedback please Leave It In the comments and That's it We can start with the video also before actually Starting if you want to know All this Material on web exploitation you can go Into the ocp repository and here I'm putting all the links to the web modules that We doing so introduction web exploitation getting Us subb suite SQL injection and Now we will do Directory traversal for the future You can expect The Following topics file inclusion file upload Common injection and cross scripting so once again That's it We can start with This video so As I said in this video We will analyze Another vulnerability Which is called Directory traversal now to understand this vulnerability We will Show some practical example This is because to learn This kind of Things You need to practice you need to create vulnerable environments in Which you can practice this Sort of stuff so in particular here in the content here I have a word list and a Directory called Tomcat here I have a Bunch of configuration and a Bunch of different web Applications And So we will talk about Static a Static site a Dynamic site and How to exploit a Directory traversal some possible remediation and How to bypass those remediation So we can with Tomcat so To actually Run a Tomcat server We need to download it so here I have the URL so I go into I Open browser I go into this tomcat. apache. org download and here I can download this Star so I can download it from here from the site or I actually prefer to do it from The Command line So This is theet Command to download it from The Command line and notice that we are downloading version 8.

5. 9 99 so now I have the I can Open it and now It's Open it here Okay so Now we can configure the server I mean There's not much to do with the server what I like to do is Simply to change the opening Port the Port where the web server is listening I'm going to change this from 88 to 137 to lit and this is the file server. xml So you go from the main Directory of apach you go into Conf you go server and then Edit this connector so just begin from the file search for connector and the first connector you see is essentially where the server will be hosted the tcp Port In which the server will be listening in initially It was 88 now I put 1237 So This is for the connector so After we change the configuration file for the server.

ml file We can make the startup script executable if It isn't already and we do this as follows so The Script are in the Folder Bin and to make them executable we do Plus xbin and then we do wildcard dis asterisk dsh Which means make all the files that End with dsh executable with a plus X So we do this and now in Bin we have a Bunch of actually not in be like this but in be like this different file to execute Run can the startup wer Over the Catalina SH do Run noce Now What Happen Now we have the server is deployed So we can go here and then we go into local 1237 and we will see our web server and Indeed If we go to local l 1237 here we are seeing the default page of apach Tomcat version 8. 5. 9 Tomcat has a lot of components So we will not really Talk that much about the internals of Tomcat however It is useful to Just describe then in General So essentially we have three main components the Catalina Coyote and Jasper Now Catalina is the container of servlet Java it implements Java servlet and Java server Pages Which are also called GSP Pages Now Java serv is a way In which can write a Java code but then Connect That Java code to a Web Application so the idea is that for some end Points our Web Application Will execute Java code to Process the request of the client so this mean We will have an application In which the backend part so the backend part is written in Java and this is typically the case for Enterprise Applications Now If you have Maybe a Small server You can Write that in Python with a backing flask in Python for a Small api however If you have a big infrastructure If you have Like an Industrial application or If you just have an Enterprise application Which is typically What Happens Most of the time you either have like dnet or Java so like you you have typically Java And there is this Technology of Java seret Which allows you to execute Java on the backend in Order to construct the final Response that Will then be sent Back To The client Now Of course Which means that we have a back so Back is is dealt with this Catalina Now Coyote instead is the http connector of Tomcat It is the interface between the tcp socket Which receives htp request and the Catalina component so like to actually get Into the execution of Java server and of jsp Pages Which We will see later on the component Which deals with the http protocol We could say Sort of like the web server is Coyote so it supports htp 1.

1 protocol it listens on tcp Port and communicates with the Tomcat Engine to Process the request and send back the responses to the client So we have Here the client Which is implemented technologically through a browser the client sends http request like it talks about the htp protocol to Coyote Which is Which listens on the Coyote Which listens on the tcp Port In which http connection is built because Remember that http is built On Top Of A tcp socket and then Coy talks to Catalina so essentially talks to Catalina and Of course Catalina There is also Jasper in this Now Jasper is Used for the compilation unit for jsp Pages Now What are jsp Pages These Are Java server Pages Which is a Technology that allows you to have in the same file html assets HTML CSS and JavaScript assets Which are typically handle render and Process by the browser and also Java code Sort of Like a way to combine these two Technologies What Do I mean with that Well here I have an example so here I have an example of a GSP Pages Which is going to Be vulnerable and we try to Attack That essentially So If you going into web apps and we do into Dynamic One and we Read this index. jsp This is a jsp like file and notice that here it contains Import statements Which are processed by Jasper and compile into Java Byte code Which is then executed by the jvm the Java Virtual machine and here You have other Java code and notice that this Java code is inserted Into The Special tags Which are processed by Jasper once again but then you also have typical HTML so like this is like a typical paragraph and here we can say like it Works a typical Header so jsp is a way to combine HTML with Java Now in this example I Do not have Java servs I Do not have a full Java seret example This is just to showcase the Basic Technology to exploit the Path traversal because This is what we have to talk about essentially so How do we get this application running to discuss the the Things for the vulnerability so I have this Folder Which will be available in myab web Apps the idea is If we go the official ap tomc here we have this web Apps Folder with a Bunch of different directories now the idea is that we want to remove All of this Directory So we can do rmr with all the names of this Directory and then we want to Copy from the Previous web example so It's Tomcat web Apps we want to Copy this three application So you want to Just Move the application of web Apps three Which is Static Dynamic One and Dynamic two just want to Move It on the web Apps Folder Within the apach Tomcat server so now the apach Tomcat Will contain this Things If you do a three Just to showcase the Directory structure we have web Apps with this three Applications Now If you open once again the browser here and we do a refresh We Get a not found because There is nothing in the root Directory Right Now however we did put stuff Into the web Apps that are in specific Folder example in Static app Which is going to be our first application that We will analyze Now If you go into slash Static app notice What Happens Now here we are loading an HTML page so It's a simple HTML page and Indeed If you go to the Static app here I'm going to Open a Terminal here in the bottom If you go into web Apps Static app notice here that what is the structure of the Directory in the operating System We file this Index html a Icon a CSS a Folder called files and a Folder called image If you go Into the image here I see a Bunch of different folders Purple eon Black The Are Just pngs so the Just Images If I go Into the files I have a file test. txt I Open this and it's Written Just Hey Now Why did I want to start off with this example this example is to showcase What is the main functionality of a simple Static web server and Web Application because When we have a simple Static Web Application the backend part actually does not really exist the back end part processes Nothing of the request of the user So we have the front end Which is the browser Which is the the Pieces of Technology That the clients interacts with makes request to the backend but in this case The backend does not really exist What is there instead is just a web server Process to look if the file requ by the user ex In The Under operating System for example When we do a request to the Static here notice that essentially we are getting the index.

htm we do View Source We getting Just the same file here I can Open it from the operating System or from the file Return by the web server these two files are and ifiles present here like for example Here's Open Another terminal here icon. png so icon. png here just get the Icon If I go Into the image If I go Into the CSS I do CSS main.

css once again here I just get the file fancy about Static saning we cann do much the most Thing the most dangerous Thing we can do is Maybe we can try to Find some sensitive file like for example this test txt Now this file Just contains Hey But if It was some sensitive data this Could Be Dangerous so in this Sort of situations the most vulnerable Thing you will find is just some sensitive data exposed by the web web server because anything that sits on this Directory is by definition exposed to the web server So This is not really a vulnerability Just How It Works if anything it can be a vulnerability if someone put sensitive data in here and this is the Basic functioning of a web server We Give it a Directory from the operating System that lees on the operating System and we Just expos to the tcp Port Over the http protocol so that http clients like the browser can request the files so here there's really nothing vulnerable and this is also to say that If you have to host some personal website or Something and you do not need to do any Sort of Processing then Just use a Static website like this like this One because It's gna like decrease the Attack Surface area of your application the only Thing the only component here that execute Codes is actually the web server It's Tom Cat Itself Which is reading the htp request and reading the file from the operating System There's no extra back there Just call for the web server if That is vulnerable Maybe you can Craft a specific htp request Which trigger some Sort of vulnerability from the web server but this typically requires to Read understand the Source Code of the web server Which is not Trivial Today We will see simpler vulnerability and the idea is that Okay we see the Static app what about the Dynamic app here I have Dynamic One Dynamic two Let's try to analyze the Dynamic behavior of the application with the Source Code let Dynamic One it says it Works Need a file to Read with me my name is index. jsp now to you Which param is it So This Sort of Like challenges Us to understand Okay it's like it's it needs a file to Read so It's asking us for a parameter for Some kind of data That the user Has to give the application means application is Dynamic in data We Send with Java code and Now We can actually start to talk about Directory traversal because If we said that the objective of the web server is to get a Folder and expose it to the htp to the htp protocol to the web server To The public to everyone who can Access the web server the Directory traversal Has to do with What kind of files are we allowed and authorized to Access because if Just file is notability however If I Can someh Force the web server to Read and give me files that are outside of this Directory like for example private file for example the passw file of Linux the Shadow file of Linux some configuration file with sensitive credential or sensitive data some of Source Code file Now if able to like files That In The public Directory and therefore That Should Not Be exposed to the internet then I have a Directory traversal Now in this case Of course it requires a parameter How can we find this parameter Now this introduces the idea of Fing Now Fing is a Technical Word it is Used in many different context in the context of the web the idea is that an http parameter is typically symbolized with something like question mark and then Something Something here so for example You can put question mark user equals me and this is a parameter Now Of course We need to understand How the parameter is called before we can actually exploit it and the Process of understanding How the parameters are called It's called fuding because essentially we do not we have no idea Which is the name of the parameter we can use Word list Which have Common names Used for Common parameters and we can just try to make with names to if changes so the that We make many request and we see if Something changes depending on the name of the parameter now to do this we can use W FS So This something that I used So What we can do is we can just here I have a word list a simple Word list and I've Made Sure that this Word list contain also the parameter that is of Interest to us for example not that Long So we do ed equals test Nothing changes So we go into Action equal test Nothing changes So we go into password equals test And So on and so forth you get the idea but Of course we want to automate it because otherwise we gna waste our entire lifetime to do This kind of thing so How can we Do It Well we can create a Python environment with Python 3-m VM VM So This is a Python Virtual environment we can activate the environment with VM been activate and then we can Install P Install W FS So we can Install W FS once we have Install W FS we can actually use it How do We use it while the idea is wfs Dash W we put the word list then we put the URL we want to FS It's local Semicolon 1237 Which is the listening Port then we say Dynamic app One and here we put here is the keyw here we put Question Mar equ test soti is this So This is the code essentially try to Open a bigger Shell so that more Clear So This is the entire Command and The Key Point is this we put FS in Capital Letters Now that Thing is gna Change depending on the words in the word list So This is like similar to pass cracking but is used the context foring the name parameters Now if execute like this No is what we get so Of course it gets Comm not found Because We need to activate the pyon environment So we Activ it in this other Shell two and then we execute it now notice What do we Get for each payload we have the Response code all 200 Almost all 200 notice What Happens with the payload file We will come back to that then we Get the number of Lines in the Response the number of Words and the number of characters and the Pay Used Now Why Does W F Give Us All this information Well the idea is simple If we trigger Some kind of code execution on the back because we guessed correctly Some kind of parameter Maybe the web server Will behave differently from the typical Static version with no Action so for example if use username Is going to reply us with 31 Words 19 Lines and 228 characters and the same Thing Will apply to title Type ID code And so and for however If we reply with file we have a lot more characters a lot more Words a lot more Lines and it replies to us with a 500 with a server error Now here we do not actually see the reply so let's go to the browser and manually Let's try with file we do file equal test and notice what we Get We Get an exception We Get an internal server Error This is a Java exception That is printed a St Trace of the exception that is printed to the user and this by Itself represents A vulnerability an informational vulnerability because now an attacker knows What's going on with the server in particular We get this Java i exception an exception Ur Processing index. jsp and notice here we also Get the code We Say look Path So we Get the server context We Get the real paat and then we do file Which apparently is the content of the file Itself we do Read All Bites of this Path We Read All the by of the file in memory into this Array of Byte and then we create a String coded with UTF and then we Just Print the String and if we see the Stack Trace here we see the Class Being Used So we have ap Tomcat we have Jasper for the jsp compilation and in General htp servlet so like Now we have all the information and we have no Such file exception So This is the root cuse This is is the main exception that was trigger that created this problem because It's Sort of like it try to read a file name test and this did not work Now once we have this code what we can do Well the idea here we do not have the full code But what we can assume From this code is that so the client Gives as a parameter the name of a file and the server through this Dynamic jsp code this Java Code embedded in a jsp Pages reads all the bite of the file it converts it into a big String and then it prints it Into the reply Into the Response Into the http Response That is then sent back by Tomcat so in this case we do have a backhand in this case The backend is Processing is reading arbitrary files Which means that If There is no Sort of validation of data and this is a really Key Concept data validation If There is no validation of data this file Could Be Anywhere because no here What Happens so here we have AIC Path then we put Dash Which is the separator of directories and then we put the Value of the parameter so like for example This is test Let's try to Read the full Source Code What Happens for example if here we put indexsp Which is the name of the file as we can see here What Happens like Now see we see it Works it Works and like View Source Code essentially we have this first have Source Code Of The Page Itself so here we have the entire Source Code and notice what we Get So we have a Bunch of Import statements then we Read the parameter from the get request So we do request.

get parameter So This Is How the Java code interacts with the http request and Of course these data structures are handled by Tomcat by the various Elements by the various components now I Do not know the internals but Thea is that the abstraction of Tomcat allows usa htp request of the Cent and now This is Java code that we can just Process the data sent by the client we can Process it And you can Send back the Response So What we say is if the file is null Which means that If There is no parameter file then we Print what we Read In The Page If we put No no file parameter so like this text So we remove The View Source We Just Print this text Need a file to Read here are the spaces HTML encoded however else in the else Block Which means that If we have a file we going Read the of the file and we're going to Print it now notice here There is no data validation What does it mean it means that Whatever We Get from the user We use it directly there is no Filter There is nothing That is blocking this Value when it is Used in this way Now What this allows Us to do Well as a malicious Attack attacker as a malicious actor we can abuse this How Well Remember that When we have a Linux file system we can use the character do Dash to go back One Directory and if we Just concatenate a Bunch of dot dot SL we can go back any directories and once We Reach the root Directory at that Point we can Maybe Go Into the ATC password d and we can Read Those kind of file so like for example Let's Prepare to testing a simple file Outside the outside like for esempio la secret. txt so like this file is very Secret Should Be and Should Be kept Hidden so like you know Just in General This is just a file and notice this file sits Outside the apach web Apps Folder Because the apach web Apps Folder is here Dynamic application have only Access to the indexsp not to the secret however if go back to the Directory We will actually be able to Access that file How Well the P Will use Is going to be like this So we going to dot Dash error out because it says look this file is actually a Directory not a file then we do SL secret. txt Let F Directory because How many How many times we have to go back So we start from Dynamic up here we go back One we go back two We just have to go back to actually We just have to go back to and essentially Let's see say no Such file Maybe have to go back three Ok we go back three and we Read the file so here can just say This is actually just a file Itself This is to say that we able to escape The public Folder Folder but abusing Directory traversal and the payload right the Pay is very simple It is just a way to Read files We Just abusing the fact that in Linux a valid file Path can contain this characters so attacker just says look This is a valid file Path and it means go back directories and then Access the fxt the vulnerability here with the fact that in the Index jsp so let's say that we do ap Tomcat web Apps Dynamic app One Index GSP in this file There is no validation that goes from the moment we Get the parameter so here to the moment We use it here we do not actually see if the Value is a legit one or it contains malicious characters for example in a Path in a file read name malici slash using slash are doing Suspicious we probably want to Escape the Jail That Should be like imposed by the web server to Only The public Folder to Access any Sort of file Within the operating System I mean in this case I use this as an example but I could also Access thec like does change that much the idea is the can repeat many times We Access any Sort of any Sort of file so That's Gen idea This is the idea Behind Directory traversals now to trigger them there are various ways this One was a very simple example that showcase no data validation at all with some jsp so that you become familiar with This kind of Technologies and then I prepare Another example Dynamic up two Dynamic two Now Dynamic app two is similar to Dynamic app One meaning that We also have a file parameter however notice here we can already see from the exception now the file Itself There is some data validation if use the Previous Pay if use the Previous Pay like this One like Straight out this one that Works for Dynamic one This time it does not work so like for Dynamic one This thing Works for this other it does not work and if we see the code printed exception we see a file replace the full the full on code essentially the same however we do have a sanitization step we do have a data validation step Which is this One so from the moment we take the Value from the http request to the moment We use it to create the Path There actually is a Filter This is a typical Black List approach Where We Say look the dot SL is malicious Right Let's remove it so it says slash to the Empty String it means remove Everything That is a dot dot slash and this data validation Works with the Basic payload dott Dash because once This is once the data validation has been applied to to this input this input actually becomes just secret.