📂 05 — Local/Remote File Inclusion
0/3 solved
🪵 Hard — Log Poisoning to RCE
This endpoint logs the User-Agent header to access.log. Poison the log with PHP/script content, then include it for RCE.
Your User-Agent is being logged. Try setting it to executable code, then include
access.log.Use
curl -H "User-Agent: <?php system(\$_GET['cmd']); ?>" to poison the log. Then include access.log with ?cmd=id. Note: this is the classic technique; the actual flag triggers just by reading access.log.