DEMO: Path Traversal

What Path Traversal Is

This is for educational and ethical hacking purposes only. This is to protect systems, not to compromise them.

This is something that goes by a couple different names: directory traversal, or it could be path traversal. I'm on the cwe.mitre.org site, and this is where we can see all of the common weaknesses. So this is the Common Weakness Enumeration, and here's a list of all of them. I'm going to expand all so that we can see everything in here, and we're going to do a search for path traversal, and we can see there's a whole series here. So here's the base one called path traversal, and then there's a relative path traversal and absolute path traversal, and then quite a few underneath here, and each one of these have a number. The main one here is 22, and then there's several variants underneath here.

So we see that it's CWE-22. Essentially what this is is that it allows some sort of input into a vulnerable product that gives us access to the file system. So the key to this is that we get access to the file system and can traverse directories and files within this file system. Now this really could be any application, but largely we look for this in web applications. So we're going to use web applications as an example to this path traversal.

The Structure of a URL

Here's the structure of our URL, which is what we use to gain access to a certain web resource. Here we have the schema, so in this case it's HTTPS. We've got the host, which gets translated to an IP address, so now we have an address where we're going to go to. Then we have the directory and file, which is our main concern when it comes to directory traversal. What this end does is it points to a specific file. So in this case right here it points to /var/www/index.html. So whatever web hosting is happening here, this is where the files are located at. And then anything after this, this is what we're navigating to. So in this case this is just a document, an HTML document, that we're then viewing through our browser.

So our URL in this case, example.com/index.html, has files on the back end that it's pointing to, and it's inside some sort of directory. So in this case it's in var www, and then we have a page here that's written in HTML. And so if we were to open up index.html, then there would be this markup language, this HTML markup language. What we're doing is we're specifying that that's what we want to access. If there's any kind of directory that's in this URL right here, that means that there's a directory in this folder. So in this case, we're accessing this index.html right here, but we're accessing it in this directory right here.

So this is what it looks like inside the operating system. An example might be, we've got our main page right here, our index.html. Then we've got a folder full of several resources. We've got some sort of page in there, and maybe we've got a few pics that are in there as well, a few JPEGs that are in there. Now, if we were on that machine, we'd be able to navigate through these different directories and find this page. We'd also be able to navigate to other areas of this operating system. Now, if a web server is set up correctly, you wouldn't be able to access some of these other files and folders, and so we would be really just stuck in this www directory right here. And that would be the only resources that we could access through this web server.

Walking the Directories on the Server

I've SSHed into a web server here. What I'm going to do is I'm going to navigate into the directory that is going to be what's hosting out the web pages. So what I'm going to do is I'm going to start out by going to cd var, and we'll do ls. And we see here, here's the www. So I'm going to get into www, and then we'll do another list. And I'm actually going one more level down, so HTML. So I'm going to do a cd HTML. We'll get into there and list out here. Now, this is going to be the primary index page for this. Right here we see some other HTML pages, and we got some other files that are in here that are being hosted out. So this is an example of a web server, and this is what the end user is supposed to see or supposed to be able to get to.

So we're going to now be able to get into a directory traversals to start looking at other areas of this operating system. So maybe I do a cd. If I just do a dot dot backslash, I can go back a level. And now notice that I've gone from the HTML directory into the www directory. I've gone back a level. I can do that again. In fact, I'm going to go back to the root directory by hitting this twice. So, dot dot slash, hit enter. Notice now I'm in the root directory.

So I can use these to get into another directory. And then what I can do is I can change direction. I am going to get into another directory here, and in this one there's going to be password. So I've got some password information that's in here. So let's try typing nano and password and get into there. And we can see a bunch of information here. This is something that we wouldn't want users to be able to log in and see, so this is where we'd want to keep them out of that. So the cd slash, that's to go back a directory level, or we can string them together to go back to many levels.

Doing It Through the URL

So there is some vulnerabilities in some web services. Here we have the URL, and then at the end of the URL we could go back two directories here, and that would get us from this www directory back — so now we're in the root directory right here — and then move forward in the etc/pass, and so then we're able to see that file right there.

So on this web server that I set up, that I'm SSHed into here, I'm actually going to go to that here. So now I'm on this website, and what I can do is I'm going to do directory traversal with this. Now in this case I got to go back three directories, and then I want to do etc and then into that file to take a look at what that file is.

Now I tell you, I cheated a little bit. This is not exactly how this would be set up. And I cheated because the version that I'm running on here is running a version that this is not susceptible on it, that you can't do directory traversal on this version of Apache. So what I'm going to do is I'm going to hit here as just an example. This is up in the URL, and then this is what you would see. And now we would have access to information that we're not supposed to have access to on this server.

So here's that attack card on path traversal. Essentially we're using application inputs to gain unauthorized access to directories and files, things that you're not intended to access but can access it through these inputs. Commonly we see it with web applications and through URLs. So that's one way that we can execute this. And the CWE for this is 22.