File Inclusion
Last updated
Last updated
Room Link: https://tryhackme.com/room/fileinc
Give Lab #1 a try to read /etc/passwd. What would the request URI be?
In Lab #2, what is the directory specified in the include function?
Give Lab #3 a try to read /etc/passwd. What is the request look like?
Input field didn't work but we were able to bypass by entering our command in the web browser instead.
URL: hxxp://10.10.230.14/lab3.php?file=..//..//../../../etc/passwd%00
Which function is causing the directory traversal in Lab #4?
file_get_contents
Try out Lab #6 and check what is the directory that has to be in the input field?
THM-profile
Try out Lab #6 and read /etc/os-release. What is the VERSION_ID value
Only worked in browser
hxxp://10.10.230.14/lab6.php?file=THM-profile//..//..//..//..//etc//os-release%00
Capture Flag1 at /etc/flag1
Capture Flag2 at /etc/flag2
Change the value from Guest to Admin and we can bypass the error message above.
Change the value to the flag and we can see it on the page.
What it would look like in burp.
Capture Flag3 at /etc/flag3
Page is getting rid of our slashes
Changing to post and added extra slashed and null character at end.
Gain RCE in Lab #Playground /playground.php with RFI to execute the hostname command. What is the output?
Kali
Created the following file to run the hostname command.
Kali
Host the file
Browser
