LFI In ASP.NET websites

In this post I will discuss about the LFI(Local File Inclusion) vulnerability exists in some of the ASP.NET Websites. Recently I was trying to find a loophole in ASP.NET websites and one day I found LFI vulnerability in some asp.net websites.

This was a script which lets the user download the file. Now there was something peculiar about this script. The script was accepting the filename which is suppose to be downloaded by the user. For example : http:/site.com/file.aspx?filename=resume.doc.  Having a closer look at it and after downloading few more files, I found that this could be a triggering point of an local file inclusion vulnerability.So I think I should give a try to download this file which is one of the most important configuration file exists on the asp.net websites- Web.Config.  To know more about it, google for it.

I knew that web.config is the most important config file for any asp.net website because it can contain passwords. Passwords for connecting to the database or local windows login passwords. Lets take a look what kind of information could be found in this file.

1. Connection string for Ms-Sqlserver database: If you are lucky you can get the user credentials to connect to the Ms-Sqlserver for the local website or may be for some other associated websites too. There is a quite possibility that even the credentials found in it is local windows user login credentials or may be the same user/password. A small TCP scan let you know about the port 3389 and let you in. After that what can be done is not the objective of this post. There will be a different post about it later.

2. Ms-Sqlserver database admin login credentials:- Ms-Sqlserver database has the admin user named "SA". If you found the user "SA" in connection string, there is a good chance that its password is also mentioned in the connection string. If it is the case, you can login using the "SA" and then create a windows admin user login. Once logged in remotely, server is yours. Then you can be more creative about rest of the network. Ok lets just do not de-viate from the topic.

One more thing, once you connect to the database remotely using db admin user "SA" try enabling the XP_CMDSHELL stored procedure. It has lot of capabilities you should be digging for. If it is disabled for normal user, there are certain ways to enable it. But if you have logged in using "SA", then it easy.

So after lots of analyses around the websites, I have found atleast 3 files used for the downloading the file have this local file inclusion vulnerability. I was surprised to found the number of websites having these files. There could be a reason that a same company or a same developer would have develops these websites.
So finally there is a list of files having the LFI vulnerability :-

• file.aspx?filename=
• downloads.aspx?filename=
• GetFile.aspx?Filename=

So now start dorking for these files.
But to make your life easier I have developed such a tool for this vulnerability called KnightRider. I am going to share it with you in a moment.
The tool named is ASPX LFI:-  This tool accepts a URL and once you selects the type of dork to be used for the site, it tries to download the web.config file by traversing the directories to a certain level.
If the file is found, tool prompts you automatically to save the file on your local disk.

Ok so here is the link for downloading :- KnightRider

If you dont want to download this tool. Mail me at mikewaals@gmail.com. I may share the source code with you if I found your intents right.

So I hope you like this post and I will continue to keep posting the tools for you.

Thanks,
MikeWaals
(I have seen a new life....)