1

I'm currently doing a CTF challenge and have extracted what I assume is the flag by injecting a relative path into the $filename parameter of a call to the PHP function

file_get_contents($filename)

that is executed by an Apache server on the target system.

I got the name of the file the flag was hidden in through a hint at some other point but I was wondering:

Is there a file that's commonly present on a Linux system that holds information about the directory structure and files contained in these directories?

I've tried searching through several log files in order to find references to interesting files but I've yet to find a detailed list of file names. I also do not have permission to read entire device files. I do have full control over the $filename parameter but from I gathered, I can only insert absolute or relative paths without wildcards in there.

2 Answers 2

1

The locate command, which is installed on most Linux machines, gets its information from a database containing all the paths on the system. A cron job maintains this database.

There are competing implementations of locate and probably competing ideas on where the database should be, so you may have to dig up a few versions to find all the places where it might be hiding. (If you were on the machine already you could locate locatedb!)

On my Debian machine it's /var/cache/locate/locatedb

1

It sounds like you're asking about the inodes and superblock. See: http://www.linfo.org/superblock and en.wikipedia.org/wiki/Inode

File systems don't have any need for a "master file" to keep track of all the files and directories contained within, per se. So, I'd say no, there is no "file that's commonly present on a Linux system that holds information about the directory structure and files contained in these directories".

However, through the use of inodes and the super block, file systems do keep track of all the files and directories. But in a distributed, non-centralized fashion.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .