Remote File Inclusion (RFI)

Overview

Remote File Inclusion (RFI) allows attackers to include and execute files from external servers. Unlike LFI, RFI enables direct remote code execution by hosting malicious files on attacker-controlled servers.

Key Difference from LFI:

  • LFI: Includes local files from the target server

  • RFI: Includes remote files from external servers controlled by the attacker

Impact:

  • Direct Remote Code Execution - Execute arbitrary code via remote scripts

  • Web Shell Deployment - Persistent access through uploaded shells

  • Server-Side Request Forgery (SSRF) - Internal network reconnaissance

  • Lateral Movement - Access internal services and systems


RFI vs LFI Functions

Functions Supporting RFI

Language
Function
Local Files
Remote URLs
RFI Capable

PHP

include() / include_once()

βœ…

βœ…

βœ…

PHP

require() / require_once()

βœ…

❌

❌

NodeJS

require()

βœ…

❌

❌

Java

import

βœ…

βœ…

βœ…

.NET

include

βœ…

βœ…

βœ…

Key Point: Only functions that support remote URLs can be exploited for RFI.


RFI Configuration Requirements

PHP Configuration

Required Settings:

Configuration Verification:


Method 1: HTTP Protocol RFI

Basic HTTP RFI

Step 1: Create Malicious PHP File

Step 2: Host on Attacker Server

Step 3: Execute RFI Attack

HTB Academy HTTP RFI Lab

Complete RFI Workflow:

Advanced HTTP RFI

Multi-Function Web Shell:


Method 2: FTP Protocol RFI

FTP Server Setup

Install and Configure FTP Server:

FTP RFI Exploitation

Basic FTP RFI:

HTB Academy FTP RFI Example:


Method 3: SMB Protocol RFI (Windows)

SMB Server Setup

Using Impacket SMB Server:

SMB RFI Exploitation

Basic SMB RFI:

Key Advantage: SMB RFI doesn't require allow_url_include = On on Windows systems.

HTB Academy SMB RFI Example:


RFI for SSRF and Internal Reconnaissance

SSRF via RFI

Internal Port Scanning:

Internal Service Enumeration:

Cloud Metadata Access

AWS Metadata Extraction:

Azure Metadata Extraction:


RFI Troubleshooting

Problem: RFI not working with HTTP

Problem: Server unreachable

Problem: File not executing

Problem: Authentication required


Tools and Resources

RFI Server Setup Scripts

HTTP Server Automation:

Multi-Protocol RFI Server:

RFI Testing Scripts

Automated RFI Testing:

Advanced RFI Payloads

Steganographic RFI:


This guide covers Remote File Inclusion techniques from HTB Academy's File Inclusion module, demonstrating how to achieve RCE and internal network access through external file inclusion.

Last updated