Pages: 1 [2] 3

Author Topic: Remote File Inclusion (RFI)  (Read 5956 times)

0 Members and 5 Guests are viewing this topic.

Online ande

  • Administrator
  • 0x13338
  • *
  • Posts: 1421
  • Karma: +81/-7
  • Gender: Male
    • View Profile
    • Evilzone
Re: Remote File Inclusion (RFI)
« Reply #15 on: August 05, 2011, 05:13:25 PM »
@1Mirek:

That may be a far short text, but like I pointed out in one of your other topics: This is to much hack-for-the-sake-of-hacking and not for the sake of learning anything. You have to build your ground information first. Ofc, you are welcome to learn the straight forward way to, but you will miss out on a lot of other information needed to understand the whole picture.
Logged

Offline 1Mirek

  • NULL
  • *
  • Posts: 26
  • Karma: +1/-7
  • Gender: Male
  • #!/usr/bin/perl
    • View Profile
    • Liquid-Security
Re: Remote File Inclusion (RFI)
« Reply #16 on: August 05, 2011, 06:35:46 PM »
hehe Ande no need to worry about me, I know very well RFI, LFI, SQLi... 
Logged

Infinityexists

  • Guest
Re: Remote File Inclusion (RFI)
« Reply #17 on: February 19, 2012, 07:15:37 PM »
AWesome tutorial , i had a good experience in PHP but never thought that i can can include external file to the victim server, thanks for great tutorial
Logged

Online Factionwars

  • Administrator
  • 0x13338
  • *
  • Posts: 1040
  • Karma: +44/-2
    • View Profile
Re: Remote File Inclusion (RFI)
« Reply #18 on: February 20, 2012, 01:43:37 PM »
Quote from: Infinityexists on February 19, 2012, 07:15:37 PM
AWesome tutorial , i had a good experience in PHP but never thought that i can can include external file to the victim server, thanks for great tutorial
Programmers like that should be prisoned,    or not,  so we keep the fun
Logged

Offline Wolf

  • Short
  • ***
  • Posts: 172
  • Karma: +11/-1
  • Gender: Male
  • Tamed wolves are naught but dogs.
    • View Profile
Re: Remote File Inclusion (RFI)
« Reply #19 on: February 20, 2012, 03:54:54 PM »
Great tut ;D  Very easy to understand.
Logged
Fear makes the Wolf bigger than he is.

Offline dataspy

  • Int
  • **
  • Posts: 106
  • Karma: +16/-3
  • Gender: Male
    • View Profile
Re: Remote File Inclusion (RFI)
« Reply #20 on: April 04, 2012, 02:28:29 AM »
Great tutorial, easy to understand!!!

I've read of another way to prevent this exploit by using in_array and then comparing against $_GET[''].

Example
Code: [Select]
<?php 
$Redirection = array('View','Edit','Delete');

    if(isset($_GET['Action']))
    {
        if(($_GET['Action'] == "View") && (in_array($_GET['Action'], $Redirection, TRUE)))
        {
            require("ViewRecord.php");
        }
        elseif(($_GET['Action'] == "Edit") && (in_array($_GET['Action'], $Redirection, TRUE)))
        {
            require("EditRecord.php");
        }
        elseif(($_GET['Action'] == "Delete") && (in_array($_GET['Action'], $Redirection, TRUE)))
        {
            require("DeleteRecord.php");
        }
        else
        {
            do something
        }
    }
    else
    {
        require("index.php"); 
    }
    ?>

I haven't tried to exploit it yet but I think it would work :)


Logged
The only people for me are the mad ones, the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn, like fabulous yellow roman candles exploding like spiders across the stars.
-Kerouac

Online ande

  • Administrator
  • 0x13338
  • *
  • Posts: 1421
  • Karma: +81/-7
  • Gender: Male
    • View Profile
    • Evilzone
Re: Remote File Inclusion (RFI)
« Reply #21 on: April 04, 2012, 04:19:28 PM »
Quote from: dataspy on April 04, 2012, 02:28:29 AM
Great tutorial, easy to understand!!!

I've read of another way to prevent this exploit by using in_array and then comparing against $_GET[''].

Example
Code: [Select]
<?php 
$Redirection = array('View','Edit','Delete');

    if(isset($_GET['Action']))
    {
        if(($_GET['Action'] == "View") && (in_array($_GET['Action'], $Redirection, TRUE)))
        {
            require("ViewRecord.php");
        }
        elseif(($_GET['Action'] == "Edit") && (in_array($_GET['Action'], $Redirection, TRUE)))
        {
            require("EditRecord.php");
        }
        elseif(($_GET['Action'] == "Delete") && (in_array($_GET['Action'], $Redirection, TRUE)))
        {
            require("DeleteRecord.php");
        }
        else
        {
            do something
        }
    }
    else
    {
        require("index.php"); 
    }
    ?>

I haven't tried to exploit it yet but I think it would work :)

That is not necessary at all, after you have done a if($n == "derp) you dont need to do a in_array() as well.
Logged

Offline dataspy

  • Int
  • **
  • Posts: 106
  • Karma: +16/-3
  • Gender: Male
    • View Profile
Re: Remote File Inclusion (RFI)
« Reply #22 on: April 04, 2012, 04:56:33 PM »
Thanks, yep I see how that is redundant :)
Logged
The only people for me are the mad ones, the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn, like fabulous yellow roman candles exploding like spiders across the stars.
-Kerouac

Online Factionwars

  • Administrator
  • 0x13338
  • *
  • Posts: 1040
  • Karma: +44/-2
    • View Profile
Re: Remote File Inclusion (RFI)
« Reply #23 on: April 04, 2012, 10:36:16 PM »
Quote from: dataspy on April 04, 2012, 04:56:33 PM
Thanks, yep I see how that is redundant :)
If you keep the inarray, you can shorten it up like a baws,   just look if the requested page is in the array, if yes include it and show it.
Logged

Offline bio_n3t

  • NULL
  • *
  • Posts: 21
  • Karma: +0/-0
    • View Profile
Re: Remote File Inclusion (RFI)
« Reply #24 on: April 07, 2012, 02:50:50 PM »
And if I use this:

<?php
if(file_exists("page/".$_GET["page"].".php"))
{
   include("page/".$_GET["page"].".php");
}
?>

It's dangerous? Thank you
Logged

Online ande

  • Administrator
  • 0x13338
  • *
  • Posts: 1421
  • Karma: +81/-7
  • Gender: Male
    • View Profile
    • Evilzone
Re: Remote File Inclusion (RFI)
« Reply #25 on: April 07, 2012, 10:17:13 PM »
Quote from: bio_n3t on April 07, 2012, 02:50:50 PM
And if I use this:

<?php
if(file_exists("page/".$_GET["page"].".php"))
{
   include("page/".$_GET["page"].".php");
}
?>

It's dangerous? Thank you


Yes. Replace ".$_GET['page']." with ../../../../../../../etc/passwd%00 and you have an LFI.
« Last Edit: April 07, 2012, 10:18:05 PM by ande »
Logged

Offline Droaxenius

  • NOP
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Re: Remote File Inclusion (RFI)
« Reply #26 on: April 10, 2012, 12:28:09 PM »
Thank you ande.
Now i remember how to do RFI and LFI :>


Great tutorial!
Logged

Offline bio_n3t

  • NULL
  • *
  • Posts: 21
  • Karma: +0/-0
    • View Profile
Re: Remote File Inclusion (RFI)
« Reply #27 on: April 11, 2012, 03:02:58 PM »
Quote from: ande on April 07, 2012, 10:17:13 PM
Yes. Replace ".$_GET['page']." with ../../../../../../../etc/passwd%00 and you have an LFI.

But also if there is a folder before the $_GET["page"]?
So in my example it will become:

include("page/../../../../../../../etc/passwd%00.php");
Logged

Online ande

  • Administrator
  • 0x13338
  • *
  • Posts: 1421
  • Karma: +81/-7
  • Gender: Male
    • View Profile
    • Evilzone
Re: Remote File Inclusion (RFI)
« Reply #28 on: April 14, 2012, 12:46:13 AM »
Quote from: bio_n3t on April 11, 2012, 03:02:58 PM
But also if there is a folder before the $_GET["page"]?
So in my example it will become:

include("page/../../../../../../../etc/passwd%00.php");

I am pretty sure, I don't have time to test. But the idea is that ../ will move you backwards in the path until you hit the root directory, then it adds etc/passwd and %00 is the null char so it and everything after it will be discarded.
Logged

Offline bio_n3t

  • NULL
  • *
  • Posts: 21
  • Karma: +0/-0
    • View Profile
Re: Remote File Inclusion (RFI)
« Reply #29 on: April 14, 2012, 04:22:08 PM »
I have done a simple test on Windows 7 and it doesn't work, may be on Linux works I don't know, or I have done something wrong!
We are waiting for other answers! :D
Logged
Pages: 1 [2] 3
 



Intern0t SoldierX py1337 SecurityOverride programisiai
Want to be here? Contact Ande or Satan911 on the forum or at IRC.