I think I am losing my marbles. I am doing a practice lab, and the machine has a server hosting a site with a RFI vulnerability.

I host a malicious php file in my /var/www/html and start the apache2 service, and then navigate to:


I have already set up a listener in metasploit. The payload executes and I get a session, but when I drop into a shell on the session, the IP address given is that of the attack box?

Am I missing something super obvious? It seems the victim server is simply executing the php script on my attack box that is serving it, rather than including it and running it on the victim server?!

I am sorry, I'm fairly new to Web App stuff, and I'm sure I am just not seeing the wood for the trees.

Cheers in advance.

  • Looking deeper, the page with the vulnerability uses require(<path given in url>); – user3046771 Jul 26 '16 at 13:06
  • Does that mean that it is not an RFI, but is simply importing the script and running it from where it is hosted instead? – user3046771 Jul 26 '16 at 13:07

By hosting it as a php file your attacker server will execute the code when apache receives a web request. This is why you get a shell from the wrong IP. Try hosting it as a .txt file instead or remove the .php binding so Apache serves the php source instead of executing it.

  • Hang on, just trying it! – user3046771 Jul 26 '16 at 13:17
  • Thanks though, had a few steps to get here, so I thought I was probably just missing something! – user3046771 Jul 26 '16 at 13:18
  • Cheers, changing it to .txt and putting a null byte %00 at the end of the url executes it correctly. – user3046771 Jul 26 '16 at 13:51
  • Now I just need to figure out what port to connect back on! – user3046771 Jul 26 '16 at 13:52
  • If null bytes won't work you can also use ? to turn the appended extension into a query string – wireghoul Jul 27 '16 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.