LFI (Local File Inclusion)

LFI (Local File Inclusion) is a web vulnerability where attackers exploit weak input validation to include local files on a server. By manipulating input fields, they can access sensitive files, execute code, or compromise the server.

Explain LFI like im 5

"Imagine you're playing a game where you can pick different toys from a toy box. But sometimes, if the game isn't set up right, a sneaky player can make the game give them toys that aren't even in the toy box—they could get toys from someone else's toy box! That's like LFI in websites. The bad guys can make the website give them access to files on the computer that they're not supposed to see. It's like someone sneaking into a toy store and taking toys from the stockroom instead of buying them."

Why this happen?

In PHP, the include() and require() functions are commonly associated with Local File Inclusion (LFI) vulnerabilities.

  1. include(): This function includes and evaluates a specified file.

  2. require(): This function is similar to include(), but it produces a fatal error (E_COMPILE_ERROR) if the specified file cannot be included.

Example Vulnerable Code

<?php include($_GET['page']); ?>
<?php include($_POST['page']); ?>
<?php include($_REQUEST['page']); ?>
<?php include($_COOKIE['page']); ?>

How this reflect on url

http://localhost/lekir/localfileinclusion.php?page=page1.php

What this do is it include page1.php into the index.php but this will introduce LFI vulnerability on the system.

How to exploit

Verify that this is a true vulnerability. Test to include common linux/windows files using path traversal / directory traversal.

Example payload (Linux Machine)

Example payload (Windows Machine)

Extracting source code

PHP Wrapper php://filter - Enable by default

This will prompt you with base64 encode data, decode the data to view the actual source code

System Command Execution

PHP Wrapper expect://LFI - Not enable by default

If disable, you will get this error

System Command Execution

PHP Wrapper php://file - Not enable by default

Payload will be send using POST method by using burp, curl or hackbar

Post data payload

or

System Command Execution - LFI2RCE

Based on this writeup, we can se that this can be use to generate arbitrary content as output. Which mean we can generatae arbitrary php code without needing to write it into a file.

Using this tools from synacktiv, we can gain remote code execution! But this payload only works on ubuntu server from my testing

php_filter_chain_generator.py

running script

Result from script

Paste it onto a url

If all the requirement meets you should get a RCE

PreviousIntroduction to Common Web VulnerabilityNextSQL Injection

Last updated