This is just a simple MD5 hash of the password for the Administrator’s FTP account! So you’ll have file system access in no time! You should also note that the options for “FileRead”, “FileWrite”, and “FileDelete” are all set to “1” (meaning true) so this user can do these actions. Settings, configurations, and more important MD5 hashed passwords for all the FTP accounts!Īs you can see, near the we have a hash value. Semi-ironically this software called “Manhali” is educational software for teaching, I suppose we’ll all learn something from this then!Īs a reminder: The software that we’re using doesn’t matter here, the only thing that matters is that it has an exploitable LFI vulnerability that we can use.

Here’s a mirror from Google’s cache as Exploit-DB’s servers are often really slow: What’s nice about their website is that they host the actual vulnerable applications along with the exploits so that you can practice/verify an exploit for yourself! In order to demonstrate this attack I’ve prepared a Windows VM with XAMPP installed on it and configured FileZilla to have a usable Administrator account.įor the vulnerable application I simply search for “local file inclusion” on Exploit-DB. It’s also worth mention that this type of LFI vector is not in the stock tool’s libraries, so I don’t think this has been done much and that surprises me quite a bit! (Seems so simple!) If you’re completely new to LFI exploitation in general here are some nifty tutorials/guides for you to read: This way I can get a good picture of what their server setup is and can more effectively exploit them. So before we start I’d like to point out that I found this out by simply copying the remote host’s installed programs on a VM of my own. So recently I was attempting to hack a friend’s server (with permission!) via a local file inclusion vulnerability and I discovered that nobody had any tutorials on hacking XAMPP servers via LFI.īasically it’s pretty straightforward if they have FileZilla FTP Server enabled and working! In fact it should be trivial to exploit this in any currently running XAMPP server with an LFI vulnerability!

Hacking XAMPP Web Servers Via Local File Inclusion (LFI)

Filezilla ftp exploit