File Inclusion

This guide contains the answer and steps necessary to get to them for the File Inclusion room.

Table of contents

• Path Traversal
• Local File Inclusion - LFI
• Local File Inclusion - LFI #2
• Challenge

Path Traversal

1. What function causes path traversal vulnerabilities in PHP?

The answer can be found in the text.

Click for answer

get_file_contents

Local File Inclusion - LFI

1. Give Lab #1 a try to read /etc/passwd. What would the request URI be?

Click for answer

/lab1.php?file=/etc/passwd

1. In Lab #2, what is the directory specified in the include function?

Click for answer

includes

Local File Inclusion - LFI #2

1. Give Lab #3 a try to read /etc/passwd. What is the request look like?

Click for answer

lab3.php?file=../../../../etc/passwd%00

1. Which function is causing the directory traversal in Lab #4?

The answer is the same as for the previous task.

Click for answer

get_file_contents

1. Try out Lab #6 and check what is the directory that has to be in the input field?

Click for answer

THM-profile

1. Try out Lab #6 and read /etc/os-release. What is the VERSION_ID value?

Click for answer

12.04

Challenge

1. Capture Flag1 at /etc/flag1

Click for answer

F1x3d-iNpu7-f0rrn

1. Capture Flag2 at /etc/flag2

Click for answer

c00k13_i5_yuMmy1

1. Capture Flag3 at /etc/flag3

Click for answer

P0st_1s_w0rk1in9

1. Gain RCE in Lab #Playground /playground.php with RFI to execute the hostname command. What is the output?

Click for answer

lfi-vm-thm-f8c5b1a78692