LFI to RCE

Tags: lfi, rce, php, wrappers

Level: advanced

Method

1. Prove file read

   /etc/passwd, windows.ini, or the framework's own config. Encoding and wrapper variants if filters exist.

   Tools: ffuf

2. PHP wrappers

   php://filter convert.base64-encode, phar://, zip://, data://. Read source first.

3. Session / log poison

   If you can put PHP into a session file, access log, or mail log, include it. Only with a benign marker.

4. Upload + include

   Upload a file the include will reach (tmp, avatars, cache).

Field notes

• On Java/Node/Python, LFI is usually 'arbitrary file read' unless a deserializer or template include is in play. Call it that.
• Do not dump /etc/shadow or customer files. One proof file is enough.

References

• https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion