Instructor: Remote file inclusion is a special case
of file inclusion vulnerabilities.
We've seen in the previous video how we were able
to include any file in the server
and have access to it through
local file inclusion vulnerabilities.
In today's video, if the server is configured
to allow a certain function called
allow_URL and allow_url_fopen,
then we will be able to include
any file from any computer into the targets website.
So will literally be able to inject
any PHP file into the target computer.
What this would lead to, is basically it will we can run
Payloads we can run reverse shells,
and we can run even system commands
and get access to the target
or full control to the target server.
So first of all, let's just go here
and we'll be using the same file Inclusion vulnerability
that we were using in the previous video.
So it's in the page parameter right here.
The only difference is you need to enable the function
that makes this that converts the local file
inclusion to our remote file inclusion.
So hence the name local, allows you to access local files
remote will allow you to access and inject remote files.
So to enable that, I'm gonna go to
my metasploitable machine, I'm just gonna show
you how to enable it so you can test
this vulnerability yourself.
So we're coming here to our Metasploitable
and I'm gonna go into the PHP settings.
So the PHP settings are stored in a file.
And to access that we're gonna use Nano,
which is a text editor.
And then I'm going to put the file location
which is an etc/php/5/tgi/php.ini
So that's the location where the PHP
configuration is stored.
I'm gonna open it using a file editor called Nano.
And I'm just gonna exit this I'm gonna
open it as pseudo as the root.
Actually in Kali, we never needed to use pseudo,
because we log in as root.
But with Metasploitable, you need to use pseudo
when you want to do root actions.
So you say pseudo, and then you put the command
that you want to run.
Okay, so these are the configurations for the PHP
that's installed on the web server on the target.
And we're looking for a function called allow_url_fopen,
so I'm gonna type in Control+W at the same time,
and that'll allow me to search and I'm going to search for
allow_url_
And we can see here that I have
allow_url_fopen is on,
And allow_url_include is on as well.
So these two functions, if they're enabled,
then the local file inclusion vulnerability
that we have can be used as a remote file inclusion.
So to exit this, Control+X and it's going to ask you
if you want to save just type in UY+Enter.
For me, I didn't change anything,
so I didn't need to do that.
Once you do that, you need to restart your web server.
So you're going to do etc/init.d/apache2 restart
And you need to do this as pseudo actually.
And this is done now. So everything should be ready for you.