Local File Inclusion
This is one of the two vulnerabilities that can open up the server to remote code execution. In this method the attacker has to be able to 2 things,
Contaminate any residing file with code that can enable LFI
Exploit directory traversal to access the file to execute the code
One of the popular methods is to contaminate the webserver's log file with a piece of code and then access the log file that will trigger the execution of the code.
Connect to the webserver using netcat and if the server is using php, then contaminate the log file with the following code,
Depending on the scripting language used on the server side, the code can be modified.
Now, access the log file using directory traveral and include the command to be executed as follows in the URL (this application is susceptible to this format, this could change based on the application that you are testing),
The above command will fetch the ip of the system and display it.
Similarly, other commands can be executed. If a reverse shell has to be executed, then the command has to be URL encoded since this URL request passes through the browser to the web application, which eventually executes it on the system. URL encoding of a command can be easily done by visiting one of the online tools for URL encoding.
URL encoded powershell reverse shell looks like this,
Other Resources
Last updated
