I think I am losing my marbles. I am doing a practice lab, and the machine has a server hosting a site with a RFI vulnerability.

I host a malicious php file in my /var/www/html and start the apache2 service, and then navigate to:


I have already set up a listener in metasploit. The payload executes and I get a session, but when I drop into a shell on the session, the IP address given is that of the attack box?

Am I missing something super obvious? It seems the victim server is simply executing the php script on my attack box that is serving it, rather than including it and running it on the victim server?!

I am sorry, I'm fairly new to Web App stuff, and I'm sure I am just not seeing the wood for the trees.

Cheers in advance.

  • Looking deeper, the page with the vulnerability uses require(<path given in url>); Jul 26, 2016 at 13:06
  • Does that mean that it is not an RFI, but is simply importing the script and running it from where it is hosted instead? Jul 26, 2016 at 13:07

1 Answer 1


By hosting it as a php file your attacker server will execute the code when apache receives a web request. This is why you get a shell from the wrong IP. Try hosting it as a .txt file instead or remove the .php binding so Apache serves the php source instead of executing it.

  • Hang on, just trying it! Jul 26, 2016 at 13:17
  • Thanks though, had a few steps to get here, so I thought I was probably just missing something! Jul 26, 2016 at 13:18
  • Cheers, changing it to .txt and putting a null byte %00 at the end of the url executes it correctly. Jul 26, 2016 at 13:51
  • Now I just need to figure out what port to connect back on! Jul 26, 2016 at 13:52
  • If null bytes won't work you can also use ? to turn the appended extension into a query string
    – wireghoul
    Jul 27, 2016 at 9:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .