First, the LFI issue.
OWASP Local File Include definition:
Local file inclusion (also known as LFI) is the process of including files, that are already locally present on the server, through the exploiting of vulnerable inclusion procedures implemented in the application. This vulnerability occurs, for example, when a page receives, as input, the path to the file that has to be included and this input is not properly sanitized, allowing directory traversal characters (such as dot-dot-slash) to be injected. Although most examples point to vulnerable PHP scripts, we should keep in mind that it is also common in other technologies such as JSP, ASP and others.
What you usually see is someone exploiting a PHP script to load a non-PHP file. In those cases, if the file does not contains
short_open_tag = On), the file will be displayed instead of executed.
/etc/passwd: it's a file on *nux systems with some information on all users: its username, name, UID, shell, and home folder.
/etc/passwd must be world-readable because it contains the UID->username mappings, home folders (so you can map
/home/users/external/u/username, for example). It does not contains the passwords anymore, those are stored on
/etc/shadow and it's restricted: only
root can read it.
/etc/passwd is world-readable, it's used as a PoC to see if you really achieved local file inclusion. If you try to include
/etc/passwd and fails, it's because the LFI failed, not because the file does not exist.