> For the complete documentation index, see [llms.txt](https://www.hackbook.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.hackbook.io/web-application-hacking/web-techniques/file-and-resource-attacks/lfi.md).
# LFI
## Basic RCE Example:
{% tabs %}
{% tab title="LFI Read" %}
If you have SQLi or can modify templates, see if you can read a system file. If this works you can try for rce. (in this case its windows with apache):
union select all 1,2,3,4,load\_file('c:/windows/system32/drivers/etc/host'),6
{% endtab %}
{% tab title="LFI RCE" %}
Find a place to upload the *backdoor.php* file or inject it with SQLi. Then use the LFI to run it on system and get RCE.
union all select 1,2,3,4,"",6 into OUTFILE 'c:/xampp/htdocs/backdoor.php'
{% endtab %}
{% endtabs %}
## **PHP WRAPPERS:**
#### Example 1:
**data:text/plain,hello world**
**T**he menu page is vulnerable to LFI attacks. If we submit a payload using a data\
wrapper, the application should treat it the text the same as a regular file and include it in the page.\
\
**data:text/plain,\**
{% hint style="info" %}
Often encodings are combined with this method. Below are a couple sources to get you started.
{% endhint %}
\
**EXAMPLE:**
------------
Found this code on the site:
include: Used to load files, (php files in this case) from the server locally and run them.\
\
In this case we can submit something other than en,fr,etc and have the server request other files. We test a common windows file to make sure our traversal works.
A null byte `%00` is used to stop the code from trying to append the php extension via the include statement.
### Log File Poison RCE:
One way to get RCE with LFI is by poisoning a log file with php then displaying the file in the browser so the php is executed. We can do this by making a bad request with nc that contains our code and then read back the log with apache php.
{% hint style="info" %}
Try other php shells if this does not work. It may also need the use of a pre tag to keep spacing. ex: \' . shell\_exec($\_GET\['cmd']) . '\';?>
{% endhint %}
This causes our request to get logged at : `c:\xampp\apache\logs\access.log`
{% hint style="warning" %}
`Match your log file type/path to the server you are attacking.`
{% endhint %}
#### Running the RCE:
Commands will be executed with the apache privs. From here a more persistent shell/backdoor can be established.