Using directory traversal attack to execute commands

Question

Is there a way to execute commands using directory traversal attacks?

For instance, I access a server's etc/passwd file like this

http://server.com/..%01/..%01/..%01//etc/passwd

Is there a way to run a command instead? Like...

http://server.com/..%01/..%01/..%01//ls

..... and get an output?

EDIT: To be clear here, I've found the vuln in our company's server. I'm looking to raise the risk level (or bonus points for me) by proving that it may give an attacker complete access to the system

Answer 1

Unless the web server is utterly hideously programmed by someone with no idea what they're doing, trying to access ls using that (assuming it even works) would result in you seeing the contents of the ls binary, and nothing else.

Which is probably not very useful.

Answer 2

Edit#2: I have edited out my comments as they were deemed sarcastic and blunt. Ok now as more information came from gAMBOOKa about this, Apache with Fedora - which you should have put into the question - I would suggest:

• Post to Apache forum, highlighting you're running latest version of Apache and running on Fedora and submit the exploit to them.
• Post to Fedora's forum, again, highlighting you're running the latest version of Apache and submit the exploit to them.
• It should be noted, include the httpd.conf to both of the sites when posting to their forums.
• To minimize access to passwd files, look into running Apache in a sandbox/chrooted environment where any other files such as passwd are not visible outside of the sandbox/chrooted environment...have you a spare box lying around to experiment with it or even better use VMWARE to simulate the identical environment you are using for the Apache/Fedora - try get it to be IDENTICAL environment, and make the httpd server run within VMWare, and remotely access the Virtual machine to check if the exploit is still visible. Then chroot/sandbox it and re-run the exploit again...
• Document the step-by-step to reproduce it and include a recommendation until a fix is found, meanwhile if there is minimal impact to the webserver running in sandbox/chrooted environment - push them to do so...

Hope this helps, Best regards, Tom.

Answer 3

Yes it is possible (the first question) if the application is really really bad (in terms of security).

http://www.owasp.org/index.php/Top_10_2007-Malicious_File_Execution

Answer 4

If you are able to view /etc/passwd as a result of the document root or access to Directory not correctly configured on the server, then the presence of this vulnerability does not automatically mean you can execute commands of your choice.

On the other hand if you are able view entries from /etc/passwd as a result of the web application using user input (filename) in calls such as popen, exec, system, shell_exec, or variants without adequate sanitization, then you may be able to execute arbitrary commands.