Remote File Include - commands running on attack box?

Question

I think I am losing my marbles. I am doing a practice lab, and the machine has a server hosting a site with a RFI vulnerability.

I host a malicious php file in my /var/www/html and start the apache2 service, and then navigate to:

/index.php?path=/evil.php

I have already set up a listener in metasploit. The payload executes and I get a session, but when I drop into a shell on the session, the IP address given is that of the attack box?

Am I missing something super obvious? It seems the victim server is simply executing the php script on my attack box that is serving it, rather than including it and running it on the victim server?!

I am sorry, I'm fairly new to Web App stuff, and I'm sure I am just not seeing the wood for the trees.

Cheers in advance.

Looking deeper, the page with the vulnerability uses require(); — user3046771, Jul 26 '16 at 13:06
Does that mean that it is not an RFI, but is simply importing the script and running it from where it is hosted instead? — user3046771, Jul 26 '16 at 13:07

score 3 · Accepted Answer · answered Jul 26 '16 at 13:09

3

By hosting it as a php file your attacker server will execute the code when apache receives a web request. This is why you get a shell from the wrong IP. Try hosting it as a .txt file instead or remove the .php binding so Apache serves the php source instead of executing it.

answered Jul 26 '16 at 13:09

wireghoul

5,745
2
17
26

Hang on, just trying it! – user3046771 Jul 26 '16 at 13:17
Thanks though, had a few steps to get here, so I thought I was probably just missing something! – user3046771 Jul 26 '16 at 13:18
Cheers, changing it to .txt and putting a null byte %00 at the end of the url executes it correctly. – user3046771 Jul 26 '16 at 13:51
Now I just need to figure out what port to connect back on! – user3046771 Jul 26 '16 at 13:52
If null bytes won't work you can also use ? to turn the appended extension into a query string – wireghoul Jul 27 '16 at 09:30

Remote File Include - commands running on attack box?

1 Answers1

Linked