Instructor: Remote file inclusion is a special case 2 2
of file inclusion vulnerabilities. 3 3
We've seen in the previous video how we were able 4 4
to include any file in the server 5 5
and have access to it through 6 6
local file inclusion vulnerabilities. 7 7
In today's video, if the server is configured 8 8
to allow a certain function called 9 9
allow_URL and allow_url_fopen, 10 10
then we will be able to include 11 11
any file from any computer into the targets website. 12 12
So will literally be able to inject 13 13
any PHP file into the target computer. 14 14
What this would lead to, is basically it will we can run 15 15
Payloads we can run reverse shells, 16 16
and we can run even system commands 17 17
and get access to the target 18 18
or full control to the target server. 19 19
So first of all, let's just go here 20 20
and we'll be using the same file Inclusion vulnerability 21 21
that we were using in the previous video. 22 22
So it's in the page parameter right here. 23 23
The only difference is you need to enable the function 24 24
that makes this that converts the local file 25 25
inclusion to our remote file inclusion. 26 26
So hence the name local, allows you to access local files 27 27
remote will allow you to access and inject remote files. 28 28
So to enable that, I'm gonna go to 29 29
my metasploitable machine, I'm just gonna show 30 30
you how to enable it so you can test 31 31
this vulnerability yourself. 32 32
So we're coming here to our Metasploitable 33 33
and I'm gonna go into the PHP settings. 34 34
So the PHP settings are stored in a file. 35 35
And to access that we're gonna use Nano, 36 36
which is a text editor. 37 37
And then I'm going to put the file location 38 38
which is an etc/php/5/tgi/php.ini 39 39
So that's the location where the PHP 40 40
configuration is stored. 41 41
I'm gonna open it using a file editor called Nano. 42 42
And I'm just gonna exit this I'm gonna 43 43
open it as pseudo as the root. 44 44
Actually in Kali, we never needed to use pseudo, 45 45
because we log in as root. 46 46
But with Metasploitable, you need to use pseudo 47 47
when you want to do root actions. 48 48
So you say pseudo, and then you put the command 49 49
that you want to run. 50 50
Okay, so these are the configurations for the PHP 51 51
that's installed on the web server on the target. 52 52
And we're looking for a function called allow_url_fopen, 53 53
so I'm gonna type in Control+W at the same time, 54 54
and that'll allow me to search and I'm going to search for 55 55
allow_url_ 56 56
And we can see here that I have 57 57
allow_url_fopen is on, 58 58
And allow_url_include is on as well. 59 59
So these two functions, if they're enabled, 60 60
then the local file inclusion vulnerability 61 61
that we have can be used as a remote file inclusion. 62 62
So to exit this, Control+X and it's going to ask you 63 63
if you want to save just type in UY+Enter. 64 64
For me, I didn't change anything, 65 65
so I didn't need to do that. 66 66
Once you do that, you need to restart your web server. 67 67
So you're going to do etc/init.d/apache2 restart 68 68
And you need to do this as pseudo actually. 69 69
And this is done now. So everything should be ready for you.