How to use File Inclusion to get Remote Code Execution?

In this short video I'm showing how to escalate Local File Inclusion to a Remote Code Execution solving a TFC CTF 2022 task named Include What Matters.

This is not a typical writeup! The priority is to explain in more detail about the vulnerabilities and tools that can be used to solve similar tasks.

In this video you can learn how what is LFI, how to find it in the application, where to find payloads to bypass LFI filtering and what are the ways to escalate it into RCE. We're gonna use Insomnia client to poison Apache logs with the code that will allow us to execute shell commands.

#capturetheflag #writeup #ctf #php #apache #logpoisoning #localfileinclusion #lfi #remotecodeexecution #rce #insomnia #payloads

00:00 Intro
00:28 Include What Matters challenge
00:55 Running Docker container
01:26 Local File Inclusion
02:44 Discovering the vulnerability
04:00 LFI to RCE
05:13 Poisoning the log
06:18 Looking for the flag

Hand Drawn icons created by Freepik - Flaticon

Music:
Goat's Skull - Verified Picasso
El Secreto - Yung Logos

[CTFSchool]

Hey! Hope you liked the video. What vulnerability should I include in my next video?

[ttrss]

Wow thats really awesome, great video.

[wilcosec]

I also like the insomnia client. Nice and simple.

[retfede]

Great video! Do you use docker very often? Is it worth learning? Thanks in advance

[darkmadarauchiha]

Enjoyed the video but got two questions
1) What made it clear to you that the log was a good place to inject code?
2) did the insomnia client just remove the need to rewrite code all the time for injection?