Remote file inclusion is a special case of file inclusion vulnerabilities.
We've seen in the previous video how we were able to include any file in the server and have access
to it through local files, including vulnerabilities in today's video, if the server is configured
to allow a certain function called allow your URL and allow you are left open, then we will be able
to include any file from any computer into the target's website.
So we'll literally be able to inject any page file into the target computer.
What this would lead to is basically it.
We can run payloads, we can run reverse shelves and we can run even system commands and get access
to the target or full control to the target server.
So first of all, let's just go here and we'll be using the same file inclusion vulnerability that we
were using in the previous video.
So it's in the page parameter right here.
The only difference is you need to enable the function that makes this, that converts the local file
inclusion to a remote file inclusion.
So hence the name local allows you to access local files.
Remote will allow you to access and inject remote files.
So to enable that, I am going to go to my old machine.
I'm just going to show you how to enable it so you can test this vulnerability yourself.
So we're coming here to our Amita's floatable and I'm going to go into the settings so the settings
are stored in a file.
And to access that, we are going to use Nonno, which is a text editor, and then I'm going to put
the file location, which is an ETSI.
Five.
DGI.
And so that's the location where the configuration is stored.
I'm going to open it using a file editor called Nonno.
And I'm just going to exit this, I'm going to open it Asuda as the root.
Actually, in Cali, we never needed to use pseudo because we log in as rude, but with Might Floatable,
you need to use pseudo when you want to do rude actions.
So you say pseudo and then you put the commands that you want to run.
OK, so these.
Are the configurations for the.
That's installed on the Web server on the target, and we're looking for a function called.
Allow yourself open, so I'm going to type in control and w at the same time, and that'll allow me
to search and I'm going to search for.
Hello, you are Al.
And we can see here that I have a lawyer I love Open is on and allow you to include is on as well.
So these two functions, if they're enabled, then the local file inclusion vulnerability that we have
can be used as a remote file inclusion.
So to exit this control and exit, and it's going to ask you if you want to save just IPY and enter
for me, I didn't change anything.
So they need to do that.
Once you do that, you need to restart your Web server.
So you're going to do ETSI and at the.
Apache to.
Restart.
And you'll need to do this as actually.
And this is done now, so everything should be ready for you.