Contents
How does log Poisoning work?
Log Poisoning is a common technique used to gain a reverse shell from a LFI vulnerability. To make it work an attacker attempts to inject malicious input to the server log. Back in the day, mostly, such injections were taking place over the server log files. Such files are the Apache error log, the Access log and more.
What is LFI vulnerability?
Remote File Inclusion (RFI) and Local File Inclusion (LFI) are vulnerabilities that are often found in poorly-written web applications. These vulnerabilities occur when a web application allows the user to submit input into files or upload files to the server. RFI vulnerabilities are easier to exploit but less common.
What is self environ?
The /proc/self/environ file. The technique we are going to examine first is the most common method used to gain a shell from an LFI. The file located under /proc/self/environ contains several environment variables such as REMOTE_PORT, HTTP_USER_AGENT and more.
What is log injection?
Log Injection (or Log Forgery) is a vulnerability that arises when un-trusted and un-validated input is allowed to be printed in system log files. As a result, an attacker can insert malicious data and false entries into the logs and ultimately corrupt the file.
What is proc self status?
The /proc/self/ directory is a link to the currently running process.
What can you do with LFI?
An attacker can use Local File Inclusion (LFI) to trick the web application into exposing or running files on the web server. An LFI attack may lead to information disclosure, remote code execution, or even Cross-site Scripting (XSS). Typically, LFI occurs when an application uses the path to a file as input.
How to carry out local file inclusion ( LFI ) poisoning?
To carry out a Local File Inclusion log poisoning, you have to be able to include apache logs (access/error). This is likely to be strenuous for the attacker since more current apache versions hinder this objective. But, experimenting is pivotal to success. Firstly, you have to know where the location of the logs are stored in.
How to use Apache log poisoning through LFI-hacking?
From the given image you can see it is showing created apache logs in the browser. Now turn on burp suite to capture the request of the same web page. Here you will get intercepted data where we need to inject our cmd comment inside user-agent by replacing highlighted data.
Can a PHP file lead to a LFI attack?
Since we had added a php file with include function inside /var/www/html which allow to read the content of another file through it and can lead to LFI attack. Let’s demonstrate it by exploring the following URL to read password files:
How to use LFI vulnerability for penetration testing?
Please read our previous article “ Beginner Guide to File Inclusion Attack (LFI/RFI)” and “ Configure Web Server for Penetration Testing (Beginner Guide)” that will help you in the configuration of own web server as well as more about LFI vulnerability. Create a PHP file which will allow the user to include a file through a file parameter.