Skip to content
attack.paths
Anmelden
← RegistryDossier · 6 steps · 5 edges

LFI → log poisoning → RCE

Local file inclusion that reads the web server's access log. Send a request whose User-Agent contains PHP, then LFI the log file to execute it.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: PHP app with an include/require parameter that doesn't sanitize traversal. Web server logs include User-Agent and the web user can read them.

§ Steps

  1. 01
    PHP payload executes as the web userExecution
    W-CMDI— OS Command Injection
  2. 02
    Drop webshell / reverse shellPersistence
    W-WEBSHELL— Webshell Deployment
  3. 03
    Inject PHP into User-AgentExecution
    W-LOG-POISONING— Log Poisoning + LFI
  4. 04
    Include the poisoned log fileLateral Movement
    W-LFI— Local File Inclusion (LFI)
  5. 05
    Find LFI parameterLateral Movement
    W-LFI— Local File Inclusion (LFI)

    ?page=../../etc/passwd / php://filter/convert.base64-encode

  6. 06
    Read source + locate logsLateral Movement
    W-PATH-TRAVERSAL— Path Traversal

§ Frequently asked

What is the "LFI → log poisoning → RCE" attack path?
Local file inclusion that reads the web server's access log. Send a request whose User-Agent contains PHP, then LFI the log file to execute it. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is PHP payload executes as the web user (W-CMDI) — a execution primitive. Assumed environment: PHP app with an include/require parameter that doesn't sanitize traversal.
What is the final impact of this kill-chain?
The final step lands on Read source + locate logs (W-PATH-TRAVERSAL), which falls under Lateral Movement. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers