Class: Ronin::Exploits::LFI

Inherits:
WebVuln show all
Defined in:
lib/ronin/exploits/lfi.rb

Overview

Represents a Local File Inclusion (LFI) exploit.

Example

require 'ronin/exploits/lfi'

module Ronin
  module Exploits
    class MyExploit < LFI

      register 'my_exploit'

      base_path '/path/to/page.php'
      query_param 'template'
      depth 7

    end
  end
end

Since:

  • 1.0.0

Constant Summary

Constants included from Mixins::HTTP

Mixins::HTTP::HTTP_USER_AGENT_ALIASES

Instance Attribute Summary

Attributes included from Mixins::HasPayload

#payload

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from WebVuln

base_path, cookie, #cookie, cookie_param, form_data, #form_data, form_param, header_name, headers, #headers, query_param, referer, #referer, request_method, #test, #url, #web_vuln_kwargs

Methods included from Mixins::HasPayload

included, #initialize, #perform_build, #perform_cleanup, #perform_launch, #perform_validate

Methods included from Mixins::HTTP

#http, #http_allowed_methods, #http_cookie, #http_copy, #http_delete, #http_get, #http_get_body, #http_get_cookies, #http_get_headers, #http_head, #http_headers, #http_lock, #http_mkcol, #http_move, #http_ok?, #http_options, #http_password, #http_patch, #http_post, #http_post_body, #http_post_headers, #http_powered_by_header, #http_propfind, #http_proppatch, #http_proxy, #http_put, #http_request, #http_response_body, #http_response_headers, #http_response_status, #http_server_header, #http_trace, #http_unlock, #http_user, #http_user_agent, included

Methods inherited from Exploit

#NotVulnerable, #Unknown, #Vulnerable, advisories, advisory, #build, #cleanup, disclosed?, disclosure_date, exploit, #exploit, #fail, #initialize, #launch, #perform_build, #perform_cleanup, #perform_launch, #perform_test, #perform_validate, quality, register, release_date, released?, software, software_versions, #test, #validate

Class Method Details

.depth(new_depth = nil) ⇒ Integer

Gets or sets the directory traversal depth for the LFI vulnerability.

Examples:

depth 7

Parameters:

  • new_depth (Integer, nil) (defaults to: nil) —

    The optional new directory traversal depth to set.

Returns:

  • (Integer) —

    The LFI vulnerability's directory traverse depth. Defaults to Ronin::Vulns::LFI::DEFAULT_DEPTH.

Since:

  • 1.0.0



85
86
87
88
89
90
91
92
93
94
95
 
# File 'lib/ronin/exploits/lfi.rb', line 85

def self.depth(new_depth=nil)
  if new_depth
    @depth = new_depth
  else
    @depth || if superclass < LFI
                superclass.depth
              else
                Vulns::LFI::DEFAULT_DEPTH
              end
  end
end

.exploit_type ⇒ Symbol

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Note:

This is used internally to map an exploit class to a printable type.

Returns the type or kind of exploit.

Returns:

  • (Symbol)

Since:

  • 1.0.0



110
111
112
 
# File 'lib/ronin/exploits/lfi.rb', line 110

def self.exploit_type
  :lfi
end

Instance Method Details

#depth ⇒ Integer

The directory traversal depth for the LFI exploit.

Returns:

  • (Integer)

See Also:

Since:

  • 1.0.0



121
122
123
 
# File 'lib/ronin/exploits/lfi.rb', line 121

def depth
  self.class.depth
end

#vuln ⇒ Ronin::Vulns::LFI

The Local File Inclusion (LFI) vulnerability to exploit.

Returns:

  • (Ronin::Vulns::LFI)

Since:

  • 1.0.0



130
131
132
133
134
135
136
137
 
# File 'lib/ronin/exploits/lfi.rb', line 130

def vuln
  @vuln ||= Vulns::LFI.new(
              url, os:            params[:os],
                   depth:         depth,
                   filter_bypass: params[:filter_bypass],
                   **web_vuln_kwargs
            )
end