FreeBSD directory listing with PHP file functions

Last week I shared a weird behavior of FreeBSD on about a directory listing with PHP file functions and Apache.

The following 3 PHP codes will output a garbled directory listing of the current directory:

echo file_get_contents("./");

While those file functions should only return content of a valid file, its possible to get a directory listing under FreeBSD. So exploiting a vulnerable script like the following becomes far more easy for an attacker, because he does not have to know the names of the files he can retrieve.



$file = $_GET['file'];
echo file_get_contents("/var/www/files/".$file);


#dirlist to see folders and files

#file disclosure of the found file “index.php”

The directory listing only works for files in the webroot.

This behavior has been tested with the following configurations while PHP is running as root:
FreeBSD 6.4 + PHP 4.4.9 (thanks to beched)
FreeBSD 7.0 + PHP 5.2.5 + Suhosin-Patch
FreeBSD 7.0 + PHP 5.2.6 + Suhosin-Patch
FreeBSD 7.2 + PHP 5.2.10

I guess it has something to do with the weird BSD file system, but I dont know yet. At least this does not work on any other platforms like ubuntu or windows (I havent checked OpenBSD yet). If someone knows more about this strange dirlist please leave a comment =)

As assumed this behavior relates to the unix file system (UFS) and should also work for NetBSD, OpenBSD and Solaris. Scipio wrote a script that will format the dirlist a bit more readable.


6 Responses to FreeBSD directory listing with PHP file functions

  1. c411k says:

    It’s a known behavior for the FreeBSD file system.

    such a script that parsing files from directory

  2. c411k says:

    mysql also gives a directory listing with load_file

  3. Reiners says:

    thanks for your input!

  4. scipio says:

    type “cat /etc/” in command line of FreeBsd, so you’ll see that Web Server, PHP or MySQL doesn’t have any relation to it. The whole point is in features of the file system “UFS” and its offshots.

  5. mr_me says:

    I know this post is old but you can list directories outside of the web root as well 8^)

  6. Miguel says:

    Interesting entry, as usual 🙂
    Is nice to see you being more active again with your blog.
    Keep the good work!

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: