FILE INCLUSION: 7. Log Poisoning

Introduction

This tutorial focuses on log poisoning as a technique for gaining Remote Code Execution (RCE) in web applications. It is particularly relevant for security enthusiasts and penetration testers looking to understand file inclusion vulnerabilities and how to exploit them effectively. By the end of this guide, you will learn how to execute commands on a server and retrieve sensitive data.

Step 1: Gain Remote Code Execution

To exploit log poisoning for RCE, follow these instructions:

1. Identify the vulnerable endpoint:

   • Look for any input fields or URL parameters that could be exploited.
   • Common targets include file upload features or any user input that gets logged.

2. Inject a payload:

   • Use a payload that will get executed when the log is processed.
   • For example, you can use a PHP wrapper to execute system commands. An example payload could be:

     <?php system($_GET['cmd']); ?>
     

   • Adjust the payload according to the server's configuration and language.

3. Trigger the payload:

   • Access the vulnerable endpoint with your injected payload by appending it to the URL, such as:

     http://target.com/vulnerable.php?cmd=whoami
     

4. Confirm execution:

   • Use a command like pwd to verify if you can execute commands on the server.
   • Submit the output from the command to confirm successful exploitation.

Step 2: Read the Flag

After successfully executing commands on the server, follow these steps to read the flag:

1. Use a different exploitation technique:

   • If your first attempt was successful, consider trying another method to ensure robustness in your approach. Techniques may include:
     • Local file inclusion (LFI)
     • Remote file inclusion (RFI)

2. Access the flag:

   • Once you have established RCE, navigate to the location where the flag is stored, typically in a directory like /.
   • Execute a command to read the flag, such as:

     cat /flag.txt
     

3. Submit the flag:

   • Capture the output from the command and submit it as required.

Conclusion

In this tutorial, you learned how to exploit log poisoning to gain RCE and read sensitive data from a vulnerable server. Always practice ethical hacking in a safe and legal environment. As you continue your learning journey, explore different techniques and understand their implications in real-world applications. Keep honing your skills in identifying and mitigating vulnerabilities to enhance your cybersecurity expertise.