How to use File Inclusion to get Remote Code Execution?
In this short video I'm showing how to escalate Local File Inclusion to a Remote Code Execution solving a TFC CTF 2022 task named Include What Matters.
This is not a typical writeup! The priority is to explain in more detail about the vulnerabilities and tools that can be used to solve similar tasks.
In this video you can learn how what is LFI, how to find it in the application, where to find payloads to bypass LFI filtering and what are the ways to escalate it into RCE. We're gonna use Insomnia client to poison Apache logs with the code that will allow us to execute shell commands.
#capturetheflag #writeup #ctf #php #apache #logpoisoning #localfileinclusion #lfi #remotecodeexecution #rce #insomnia #payloads
00:00 Intro
00:28 Include What Matters challenge
00:55 Running Docker container
01:26 Local File Inclusion
02:44 Discovering the vulnerability
04:00 LFI to RCE
05:13 Poisoning the log
06:18 Looking for the flag
Hand Drawn icons created by Freepik - Flaticon
Music:
Goat's Skull - Verified Picasso
El Secreto - Yung Logos