File: ids/lfi.sh

#!/usr/bin/env bash
#=============================================================================
# Sentinela ? Intelligent Linux Security Framework
# ids/lfi.sh ? Detección de Local File Inclusion
#=============================================================================
#
# Detecta intentos de inclusión de archivos locales.
#
# Vectores cubiertos:
# - Path traversal (../../../etc/passwd)
# - PHP wrappers (php://filter, php://input, expect://)
# - data:// URIs
# - /proc/self/environ
# - /proc/self/fd/*
# - Null byte injection (%00)
# - Double encoding
#=============================================================================

# shellcheck source=lib/common.sh
source "${SENTINELA_DIR}/lib/common.sh"

#=============================================================================
# Patrones LFI
#=============================================================================
LFI_PATTERNS=(
    # Path traversal básico
    '\.\./\.\./'
    '\.\.\\\.\.\\'
    '\.\.%2f\.\.'
    '\.\.%5c\.\.'
    '%2e%2e%2f'
    '%2e%2e%5c'

    # Archivos sensibles
    '/etc/passwd'
    '/etc/shadow'
    '/etc/hosts'
    '/etc/hostname'
    '/etc/issue'
    '/etc/os-release'
    '/etc/apt/sources.list'
    '/etc/ssh/sshd_config'
    '/etc/my\.cnf'
    '/etc/mysql/my\.cnf'
    '/etc/php/'
    '/etc/httpd/'
    '/etc/apache2/'

    # /proc filesystem
    '/proc/self/environ'
    '/proc/self/fd/'
    '/proc/self/cmdline'
    '/proc/self/maps'
    '/proc/1/cwd'
    '/proc/1/root'

    # PHP wrappers
    'php://filter'
    'php://input'
    'php://output'
    'php://memory'
    'php://temp'
    'php://fd'
    'expect://'
    'phar://'

    # data wrapper
    'data://'
    'data:text'
    'data:application'

    # Windows files (via Wine/CrossOver)
    'c:\\boot\.ini'
    'c:\\windows\\'
    'c:\\winnt\\'

    # Null byte injection
    '%00'
    '%2500'
    '\\\\0'

    # Log poisoning paths
    '/var/log/apache2/'
    '/var/log/nginx/'
    '/var/log/httpd/'
    '/var/log/mysql/'
    '/var/log/auth\.log'
    '/var/log/syslog'
    '/var/log/messages'
    '/var/mail/'
    '/var/spool/mail/'

    # SSH keys
    '/\.ssh/id_rsa'
    '/\.ssh/id_dsa'
    '/\.ssh/authorized_keys'
    '/\.ssh/config'
    '/\.ssh/known_hosts'

    # Config files
    '/\.git/config'
    '/\.svn/entries'
    '/\.hg/store'
    '/\.bashrc'
    '/\.bash_history'
    '/\.mysql_history'
    '/\.viminfo'
    '/\.npmrc'
    '/\.aws/credentials'
    '/\.azure/accessTokens.json'
    '/\.gcloud/credentials'
    '/\.kube/config'

    # DB files
    '/\.sqlite'
    '/\.db'
    '/database\.sql'
    '/backup\.sql'
    '/dump\.sql'
    '/wp-config\.php'
    '/configuration\.php'
    '/config\.php'
    '/settings\.php'
    '/db\.php'
    '/conn\.php'
    '/connection\.php'
    '/database\.php'
    '/global\.php'
    '/local\.php'
    '/env\.php'
)

#=============================================================================
# Verificar si una URI contiene LFI
#=============================================================================
lfi_check() {
    local uri="$1"
    local decoded_uri

    # Decodificar URL
    decoded_uri=$(echo "${uri}" | python3 -c "import sys,urllib.parse; print(urllib.parse.unquote(sys.stdin.read()))" 2>/dev/null || echo "${uri}")

    for pattern in "${LFI_PATTERNS[@]}"; do
        if echo "${decoded_uri}" | grep -qiP "${pattern}"; then
            echo "${pattern}"
            return 0
        fi
    done

    return 1
}