Remote file inclusion is a special case of file inclusion vulnerabilities we've seen in the previous
videoke how we were able to include any file in the server and have access to it through local file
inclusion vulnerabilities.
In today's video if the server is configured to allow a certain function called allow your owl and allow
your eye open then we will be able to include any file from any computer into the Target's Web site.
So we'll literally be able to inject any ph file into the target computer.
What this would lead to is basically if we can run payloads we can run reverse shells and we can run
even system commands and get access to the target or full control to the target server.
So first of all let's just go here and we'll be using the same file inclusion learnability that we were
using in the previous video.
So it's in the page parameter right here.
The only difference is you need to enable the function that makes this that converts the local file
inclusion to a remote file inclusion.
So has the name local allows you to access local files.
Remote will allow you to access and inject remote files so to enable that I'm going to go to my metastable
machine I'm just going to show you how to enable it so you can test this vulnerability yourself.
So we're coming here to our with us floatable and I'm going to go into the PH settings so the PH settings
are stored in a file and to access that we're going to use nano which is a text editor.
And then I'm going to put the file location which is in UTC ph 5 DGI.
And PSAP that I.A..
So that's the location where the BHP configuration is stored.
I'm going to open it using a file is circled.
Not know and I'm just going to exit this.
I'm going to open it as pseudo as the root actually in Cali we never needed to use sudo because we luggin
as rude.
But.
US Slater Well you need to use sudo when you want to do root actions.
So you say sudo and then you put the command that you want to run.
OK so these are the configurations for the HP that's installed on the web server on the target.
And we're looking for a function called allow your l f open.
So I'm going to type in control and W at the same time and that'll allow me to search and I'm going
to search for
your and we can see here that I have a life URL of Open is on and allow you to include it's own as well.
So these two functions if they're enabled then the local file inclusion vulnerability that we have can
be used as a remote file inclusion so to exit this control and exit.
And it's going to ask you if you want to save just IPY and enter.
For me I didn't change anything so I didn't need to do that.
Once you do that you need to restart your web server so you're going to do it you see and that's the
Apache to restart and you'll need to do the Sussudio actually.
And this is done now so everything should be ready for you.