https://www.yusufalmahmeed.com/tags/lfi/Recent content in Lfi on Yusuf AlMahmeedHugoen-us© 2026 Yusuf AlMahmeed · <a href="https://www.yusufalmahmeed.com/privacy/">privacy</a>Sat, 10 Oct 2026 00:00:00 +0000https://www.yusufalmahmeed.com/posts/inclusiveness/Sat, 10 Oct 2026 00:00:00 +0000https://www.yusufalmahmeed.com/posts/inclusiveness/<table> <thead> <tr> <th></th> <th></th> </tr> </thead> <tbody> <tr> <td><strong>Machine</strong></td> <td>Inclusiveness</td> </tr> <tr> <td><strong>Platform</strong></td> <td>OffSec Proving Grounds</td> </tr> <tr> <td><strong>Difficulty</strong></td> <td>Intermediate</td> </tr> <tr> <td><strong>OS</strong></td> <td>Linux (Debian 10)</td> </tr> <tr> <td><strong>Learning Path</strong></td> <td>Web fundamentals / OSWA &amp; OSCP prep</td> </tr> <tr> <td><strong>Key Techniques</strong></td> <td>User-Agent bypass, LFI, anonymous FTP upload, LFI-to-RCE, SUID PATH hijacking</td> </tr> <tr> <td><strong>Est. Time to Complete</strong></td> <td>~45–60 min</td> </tr> </tbody> </table> <!-- TODO(Yusuf): confirm the Proving Grounds difficulty rating for Inclusiveness. --> <h2 id="overview">Overview</h2> <p>Inclusiveness lives up to its name: the whole box is a chain of <strong>file inclusion</strong>. A hidden <code>robots.txt</code> that only answers search-engine bots points to a <code>/secret_information/</code> page with a <code>lang</code> parameter that includes files with no sanitization, a classic <strong>Local File Inclusion (LFI)</strong>. By reading the FTP server&rsquo;s own config through that LFI, we learn where anonymous FTP uploads land on disk, upload a PHP reverse shell, and include it to land a shell as <code>www-data</code>. Root comes from a custom <strong>SUID</strong> helper in <code>tom</code>&rsquo;s home directory that calls <code>whoami</code> by its bare name, so prepending a fake <code>whoami</code> to <code>PATH</code> makes it hand us a root shell.</p>