LFI code execution when directory specified

Question

I am working on hackme, which introduce LFI in php code.

<?php
if (isset($_COOKIE["user"])) {
    $file="txt/".$_COOKIE["user"];
    include $file;
}
?>

So I can include any file from the system by just setting cookie user to file location, eg: "../../../etc/passwd".

Is there any way to use this vulnerability to execute my own php code?

I have tried using:

• /proc/self/environ
• /proc/self/fd/0
• /proc/self/fd/1
• /proc/self/fd/...

neither was working (no results) and errors was similar to this one:

include(txt/../../../proc/self/fd/2): failed to open stream: Permission denied

Answer 1

Well, there may be many ways to do something like this. I agree with the comments regarding doing some research into exactly what an LFI is doing, and looking a bit at RFIs to help understand the implicit differences.

As to your question, the answer would be yes, but strictly theoretical as we have no direct interaction with the application, therefore I do not know if the application is even vulnerable to other vectors that may come into play.

Without giving you the answer, as these types of vulnerable applications are for learning on your own, there are multiple ways to potentially execute PHP via LFI, most involving uploading a file in some way, but that's not nearly always the case. Some examples: via some sort of stored comments, accessing the page via LFI and having the code execute; via uploading through some sort of file upload functionality and accessing the shell you uploaded via the LFI; via turning your LFI into an RFI (have you tried?); via escaping the command that's causing the file read (your injection point), and running PHP after it, and a plethora of other potentials.

Since you control the cookie and it's reflected directly into the PHP, have you simply tried cleanly closing the statement the cookie gets dumped into, and writing more PHP afterward? This would be the first thing I would try when a value gets reflected, unmodified, into code in use on the server.

Hopefully this can be an answer 'enough'. These types of questions are a bit subjective, but this may help.