LOG POISONING LFI - RCE
A corporate instruments portal resolves its internal pages through a single page parameter, vulnerable to Local File Inclusion. Bypass the traversal filter to pull in the web server's own access log, poison it with a crafted User-Agent, and re-include it to gain remote code execution. From there, hunt down flag.txt hidden inside a non-obvious, out-of-webroot directory on the server.
# 1. Extract the archive you just downloaded — on your own box, not a server.
you@host:~$ unzip log-poisoning-lfi-rce.zip && cd log-poisoning-lfi-rce
# 2. Boot the vulnerable machine. It prints the IP it was assigned.
you@host:~$ sudo bash deploy.sh log-poisoning-lfi-rce.tar
# 3. Point your tools at that IP. Ctrl+C here tears it back down when you're done.
Learn more
Read the theory behind this lab before diving in.
Submit flags
Log in to submit flags and track your progress.