Remote File Inclusion (RFI)
RFI vulnerabilities are less common than LFIs
since the target system must be configured in a specific way.
In PHP web applications, for example,
the allow_url_include option needs to be enabled to leverage RFI,
just as with the data:// wrapper from the previous section.
While LFI vulnerabilities can be used to include local files,
RFI vulnerabilities allow us to include files from a remote system
over HTTP or SMB.
The included file is also executed in the context of the web application.
Common scenarios where we’ll find this option enabled
is when the web application loads files or contents from remote systems,
like libraries or application data.
We can discover RFI vulnerabilities using the same techniques
covered in the Directory Traversal and LFI sections.
Kali Linux includes several PHP webshells that can be used for RFI.
A webshell is a small script that provides a web-based command line interface,
making it easier and more convenient to execute commands.
In this example,
we’ll use the simple-backdoor.php webshell
to exploit an RFI vulnerability in the “Mountain Desserts” web application.
First, let’s briefly review the contents of the webshell.
We’ll use it to test the LFI vulnerability from the previous sections for RFI.
The code is very similar to the PHP snippet we used in previous sections.
It accepts commands in the cmd parameter and executes them via the system function.
To leverage an RFI vulnerability,
we need to make the remote file accessible by the target system.
We can use the Python http.server module to start a web server on our Kali machine
and serve the file we want to include remotely on the target system.
After the web server is running,
we have completed all necessary steps on our attacking machine.
Next, we’ll use curl to include the hosted file via HTTP
and specify ls as our command.
We successfully exploited an RFI vulnerability
by including a remotely hosted webshell.