Learning Web Pentesting With DVWA Part 6: File Inclusion

In this article we are going to go through File Inclusion Vulnerability. Wikipedia defines File Inclusion Vulnerability as: "A file inclusion vulnerability is a type of web vulnerability that is most commonly found to affect web applications that rely on a scripting run time. This issue is caused when an application builds a path to executable code using an attacker-controlled variable in a way that allows the attacker to control which file is executed at run time. A file include vulnerability is distinct from a generic directory traversal attack, in that directory traversal is a way of gaining unauthorized file system access, and a file inclusion vulnerability subverts how an application loads code for execution. Successful exploitation of a file inclusion vulnerability will result in remote code execution on the web server that runs the affected web application."
There are two types of File Inclusion Vulnerabilities, LFI (Local File Inclusion) and RFI (Remote File Inclusion). Offensive Security's Metasploit Unleashed guide describes LFI and RFI as:
"LFI vulnerabilities allow an attacker to read (and sometimes execute) files on the victim machine. This can be very dangerous because if the web server is misconfigured and running with high privileges, the attacker may gain access to sensitive information. If the attacker is able to place code on the web server through other means, then they may be able to execute arbitrary commands.
RFI vulnerabilities are easier to exploit but less common. Instead of accessing a file on the local machine, the attacker is able to execute code hosted on their own machine."
In simpler terms LFI allows us to use the web application's execution engine (say php) to execute local files on the web server and RFI allows us to execute remote files, within the context of the target web server, which can be hosted anywhere remotely (given they can be accessed from the network on which web server is running).
To follow along, click on the File Inclusion navigation link of DVWA, you should see a page like this:

Lets start by doing an LFI attack on the web application.
Looking at the URL of the web application we can see a parameter named page which is used to load different php pages on the website.

http://localhost:9000/vulnerabilities/fi/?page=include.php 

Since it is loading different pages we can guess that it is loading local pages from the server and executing them. Lets try to get the famous /etc/passwd file found on every linux, to do that we have to find a way to access it via our LFI. We will start with this:

../etc/passwd 

entering the above payload in the page parameter of the URL:

http://localhost:9000/vulnerabilities/fi/?page=../etc/passwd 

we get nothing back which means the page does not exist. Lets try to understand what we are trying to accomplish. We are asking for a file named passwd in a directory named etc which is one directory up from our current working directory. The etc directory lies at the root (/) of a linux file system. We tried to guess that we are in a directory (say www) which also lies at the root of the file system, that's why we tried to go up by one directory and then move to the etc directory which contains the passwd file. Our next guess will be that maybe we are two directories deeper, so we modify our payload to be like this:

../../etc/passwd 

we get nothing back. We continue to modify our payload thinking we are one more directory deeper.

../../../etc/passwd 

no luck again, lets try one more:

../../../../etc/passwd 

nop nothing, we keep on going one directory deeper until we get seven directories deep and our payload becomes:

../../../../../../../etc/passwd 

which returns the contents of passwd file as seen below:

This just means that we are currently working in a directory which is seven levels deep inside the root (/) directory. It also proves that our LFI is a success. We can also use php filters to get more and more information from the server. For example if we want to get the source code of the web server we can use php wrapper filter for that like this:

php://filter/convert.base64-encode/resource=index.php 

We will get a base64 encoded string. Lets copy that base64 encoded string in a file and save it as index.php.b64 (name can be anything) and then decode it like this:

cat index.php.b64 | base64 -d > index.php 

We will now be able to read the web application's source code. But you maybe thinking why didn't we simply try to get index.php file without using php filter. The reason is because if we try to get a php file with LFI, the php file will be executed by the php interpreter rather than displayed as a text file. As a workaround we first encode it as base64 which the interpreter won't interpret since it is not php and thus will display the text. Next we will try to get a shell. Before php version 5.2, allow_url_include setting was enabled by default however after version 5.2 it was disabled by default. Since the version of php on which our dvwa app is running on is 5.2+ we cannot use the older methods like input wrapper or RFI to get shell on dvwa unless we change the default settings (which I won't). We will use the file upload functionality to get shell. We will upload a reverse shell using the file upload functionality and then access that uploaded reverse shell via LFI.
Lets upload our reverse shell via File Upload functionality and then set up our netcat listener to listen for a connection coming from the server.

nc -lvnp 9999 

Then using our LFI we will execute the uploaded reverse shell by accessing it using this url:

http://localhost:9000/vulnerabilities/fi/?page=../../hackable/uploads/revshell.php 

Voila! We have a shell.

To learn more about File Upload Vulnerability and the reverse shell we have used here read Learning Web Pentesting With DVWA Part 5: Using File Upload to Get Shell. Attackers usually chain multiple vulnerabilities to get as much access as they can. This is a simple example of how multiple vulnerabilities (Unrestricted File Upload + LFI) can be used to scale up attacks. If you are interested in learning more about php wrappers then LFI CheetSheet is a good read and if you want to perform these attacks on the dvwa, then you'll have to enable allow_url_include setting by logging in to the dvwa server. That's it for today have fun.
Leave your questions and queries in the comments below.

References:

1. FILE INCLUSION VULNERABILITIES: https://www.offensive-security.com/metasploit-unleashed/file-inclusion-vulnerabilities/
2. php://: https://www.php.net/manual/en/wrappers.php.php
3. LFI Cheat Sheet: https://highon.coffee/blog/lfi-cheat-sheet/
4. File inclusion vulnerability: https://en.wikipedia.org/wiki/File_inclusion_vulnerability
5. PHP 5.2.0 Release Announcement: https://www.php.net/releases/5_2_0.php

More info

1. Hack Tools Github
2. Hacker Tools For Windows
3. Hacking Tools Pc
4. Hacking Tools For Games
5. Hack Tools
6. Hacker Tool Kit
7. Best Pentesting Tools 2018
8. Hack Tools For Pc
9. Hacking Tools For Beginners
10. Free Pentest Tools For Windows
11. How To Hack
12. Hacker Tools For Pc
13. Best Hacking Tools 2020
14. Pentest Tools Open Source
15. Hacking Tools And Software
16. Hacker Techniques Tools And Incident Handling
17. Nsa Hack Tools
18. Ethical Hacker Tools
19. Hack Tools For Ubuntu
20. Hacker
21. Hacker Tools For Pc
22. Hacking Tools
23. Pentest Tools Nmap
24. Hacker Tools For Mac
25. Install Pentest Tools Ubuntu
26. Hack Tools
27. Pentest Tools Alternative
28. Pentest Tools Website Vulnerability
29. Hack Tools For Games
30. Hacking Apps
31. Hacker Techniques Tools And Incident Handling
32. Hacking Tools Name
33. Beginner Hacker Tools
34. Pentest Tools Open Source
35. Pentest Tools Windows
36. Hacking Tools Hardware
37. Install Pentest Tools Ubuntu
38. Hack Tools Online
39. Hacking Tools For Games
40. Hacker Tools Free Download
41. Pentest Tools Website
42. What Are Hacking Tools
43. Hacking Tools Usb
44. Hacker Tools Online
45. Hack Tools For Mac
46. Hack Tools For Mac
47. Best Pentesting Tools 2018
48. Hack Tools Download
49. Hacker Tools Hardware
50. Hacker Techniques Tools And Incident Handling
51. Hacker Tools
52. How To Install Pentest Tools In Ubuntu
53. What Is Hacking Tools
54. How To Install Pentest Tools In Ubuntu
55. Hacker Techniques Tools And Incident Handling
56. Pentest Tools For Ubuntu
57. What Is Hacking Tools
58. Hacks And Tools
59. Hacking Tools For Windows 7
60. Pentest Tools For Windows
61. Tools Used For Hacking
62. Beginner Hacker Tools
63. Hacker Tools Github
64. Hacking Tools Software
65. Hack And Tools
66. Pentest Tools Nmap
67. Hacking Tools Hardware
68. Hacking Tools Online
69. Hacking Tools Software
70. Kik Hack Tools
71. Hacker Search Tools
72. Hacking Tools Hardware
73. Hacking Apps
74. Pentest Tools Url Fuzzer
75. Pentest Tools Online
76. Pentest Tools Download
77. Hacker Tools Online
78. Hacking Tools Kit
79. Hack Tools Github
80. Hack Tools Download
81. Pentest Tools Free
82. Usb Pentest Tools
83. Hacking Tools Name
84. Blackhat Hacker Tools
85. Pentest Tools Android
86. Hacker Tools List
87. Pentest Tools Url Fuzzer
88. Hacking Tools For Windows
89. Hacker Tools Apk
90. Pentest Tools Tcp Port Scanner
91. Hak5 Tools
92. Physical Pentest Tools
93. Hacking Tools Online
94. Pentest Tools Apk
95. Hak5 Tools
96. How To Hack
97. Hacks And Tools
98. Pentest Tools Review
99. Hacking Tools For Windows Free Download
100. Pentest Tools Website Vulnerability
101. Nsa Hacker Tools
102. Tools Used For Hacking
103. Usb Pentest Tools
104. Hack And Tools
105. Bluetooth Hacking Tools Kali
106. Hacker Tools 2020
107. Hack Website Online Tool
108. Pentest Tools For Windows
109. Nsa Hack Tools Download
110. Pentest Tools Kali Linux
111. Hacker Tools Hardware
112. Hacker Hardware Tools
113. Hacker Tools For Pc
114. Pentest Tools Tcp Port Scanner
115. Hack Tool Apk No Root
116. Pentest Tools Github
117. Hacking Tools Windows
118. Hacking Tools Windows
119. Hack Tool Apk No Root
120. How To Make Hacking Tools
121. Hack Tools Download
122. Hacking Tools Free Download
123. Hacking Tools For Pc
124. Pentest Tools Windows
125. Hacking Tools Software
126. Hacking Tools Free Download
127. Hackrf Tools
128. Pentest Box Tools Download
129. Hack Tools For Pc
130. What Are Hacking Tools
131. Hacker Tools List
132. Hacker Tools Software
133. Hack Website Online Tool
134. Hacker Tools Windows