[TakeMySS]

Hello ,


Today I would like to make you aware of the LFI. We see a lot of SQLI but LFI are just as dangerous.



For a demonstration we will take a random site :

https://www.vanillaforest.tw/



Anyway we look quickly and we find :

index.php?page=about.php

https://i.imgflip.com/7qxbwk.jpg

We could stop there, and simply try to break the hashes & connect in SSH... But, I am not x0rz whitehat for report to sys-admin.

So as a good son of a bitch. We're going to fuck this site   

Since we can use filters (php://filter=...). We can try to make a chain to have an RCE. 

takemyss@breached: ~/$ python3 php_filter_chain_generator.py --chain '<?php phpinfo(); ?>'

Enjoy 

https://www.icegif.com/wp-content/upload...if-259.gif

[0xDEADC0DE]

There are no hashes in /etc/passwd.

[TakeMySS]

There are no hashes in /etc/passwd.

/etc/shadow mb

[H4rDw4Y]

LFI is the first step or foothold, was you want, next step is to exploit with something more interesting

LFI2RCE and LFI ressources : 

https://aditya-chauhan17.medium.com/loca...94e15870e1

https://github.com/RoqueNight/LFI---RCE-Cheat-Sheet

https://book.hacktricks.xyz/pentesting-w...-inclusion

https://www.thehacker.recipes/web/inputs...lfi-to-rce

[FBI]

There are no hashes in /etc/passwd.

/etc/shadow mb

LFI on things like /etc/shadow assume that whatever running the php process is running with root. If that's happening, you have bigger problems.

[TakeMySS]

LFI is the first step or foothold, was you want, next step is to exploit with something more interesting

LFI2RCE and LFI ressources : 

https://aditya-chauhan17.medium.com/loca...94e15870e1

https://github.com/RoqueNight/LFI---RCE-Cheat-Sheet


Hi, great documentation. But the path to apache log be often disable. So thx for ur reply bro <3

https://book.hacktricks.xyz/pentesting-w...-inclusion

https://www.thehacker.recipes/web/inputs...lfi-to-rce

don't forget reputation please