[{"data":1,"prerenderedAt":545},["ShallowReactive",2],{"post-idor-lfi-rce":3},{"id":4,"title":5,"body":6,"description":531,"extension":532,"meta":533,"navigation":540,"path":541,"seo":542,"stem":543,"__hash__":544,"dateDisplay":538,"image":539,"tags":535,"badge":534,"readingTime":74},"posts\u002Fposts\u002Fidor-lfi-rce.md","IDOR, LFI & RCE",{"type":7,"value":8,"toc":529},"minimark",[9,17,38,43,90,100,105,125,131,136,160,165,170,183,188,213,222,226,244,249,253,283,287,292,297,351,356,389,398,402,436,441,525],[10,11,12,16],"p",{},[13,14,15],"strong",{},"Định nghĩa ngắn:"," LFI xảy ra khi ứng dụng cho phép include\u002F đọc file trên máy chủ dựa trên input của user mà không kiểm soát — attacker có thể đọc file cục bộ, lộ thông tin nhạy cảm, hoặc kết hợp với file upload → RCE.",[10,18,19,22,23,27,28,27,31,27,34,37],{},[13,20,21],{},"Cơ chế:"," thường do dùng ",[24,25,26],"code",{},"include",", ",[24,29,30],{},"require",[24,32,33],{},"file_get_contents",[24,35,36],{},"readfile"," với tham số từ user mà không sanitize\u002Fcanonicalize.",[10,39,40],{},[13,41,42],{},"Ví dụ (PHP — vulnerable):",[44,45,50],"pre",{"className":46,"code":47,"language":48,"meta":49,"style":49},"language-php shiki shiki-themes github-light github-dark","\u003C?php\n\u002F\u002F vulnerable.php\n\u002F\u002F WARNING: minh hoạ lỗ hổng; chỉ dùng để hiểu\n$page = $_GET['page'];               \u002F\u002F user-controlled\ninclude(\"\u002Fvar\u002Fwww\u002Fpages\u002F\" . $page);  \u002F\u002F nếu không kiểm tra => LFI\n?>\n","php","",[24,51,52,60,66,72,78,84],{"__ignoreMap":49},[53,54,57],"span",{"class":55,"line":56},"line",1,[53,58,59],{},"\u003C?php\n",[53,61,63],{"class":55,"line":62},2,[53,64,65],{},"\u002F\u002F vulnerable.php\n",[53,67,69],{"class":55,"line":68},3,[53,70,71],{},"\u002F\u002F WARNING: minh hoạ lỗ hổng; chỉ dùng để hiểu\n",[53,73,75],{"class":55,"line":74},4,[53,76,77],{},"$page = $_GET['page'];               \u002F\u002F user-controlled\n",[53,79,81],{"class":55,"line":80},5,[53,82,83],{},"include(\"\u002Fvar\u002Fwww\u002Fpages\u002F\" . $page);  \u002F\u002F nếu không kiểm tra => LFI\n",[53,85,87],{"class":55,"line":86},6,[53,88,89],{},"?>\n",[10,91,92,95,96,99],{},[13,93,94],{},"Vấn đề:"," attacker có thể truyền ",[24,97,98],{},"..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd"," (path traversal) hoặc kết hợp upload webshell rồi include nó.",[10,101,102],{},[13,103,104],{},"Phát hiện \u002F dò (lab):",[106,107,108,112,119,122],"ul",{},[109,110,111],"li",{},"Tìm endpoint dùng include\u002Fread file (page, template, download, logs).",[109,113,114,115,118],{},"Thử path traversal (",[24,116,117],{},"..\u002F",") variations, URL-encode, null-byte (cũ) trong lab.",[109,120,121],{},"Kiểm tra response chứa nội dung file, lỗi tiết lộ path, hoặc khác biệt nội dung.",[109,123,124],{},"Kết hợp với file upload: upload file rồi include nó.",[10,126,127,130],{},[13,128,129],{},"Hậu quả:"," lộ config, creds, source code; RCE nếu kết hợp upload + include executable; thông tin nhạy cảm.",[10,132,133],{},[13,134,135],{},"Phòng ngừa \u002F fix:",[106,137,138,141,144,151,154,157],{},[109,139,140],{},"Không dùng input trực tiếp làm path. Dùng allowlist (map key → file path).",[109,142,143],{},"Canonicalize & normalize path, rồi verify path nằm trong thư mục an toàn (chroot-like).",[109,145,146,147,150],{},"Không cho phép ",[24,148,149],{},".."," hoặc các ký tự path traversal; reject hoặc encode.",[109,152,153],{},"Nếu cần đọc file user-provided: chỉ cho phép filename đơn (không path), hoặc lookup từ DB.",[109,155,156],{},"Hạn chế quyền tài khoản webserver (no read of \u002Fetc, minimal privileges).",[109,158,159],{},"Tắt hiển thị lỗi chi tiết trên production.",[161,162,164],"h1",{"id":163},"_2-idor-insecure-direct-object-reference","2) IDOR — Insecure Direct Object Reference",[10,166,167,169],{},[13,168,15],{}," IDOR là khi ứng dụng sử dụng identifier trực tiếp (id, filename, uuid) để truy xuất tài nguyên mà không kiểm tra authorization — attacker thay id để truy cập tài nguyên người khác.",[10,171,172,174,175,178,179,182],{},[13,173,21],{}," thiếu kiểm tra quyền khi mapping ",[24,176,177],{},"user -> object id",". Ví dụ ",[24,180,181],{},"GET \u002Fdownload?file_id=1234"," mà server chỉ check tồn tại chứ không check owner.",[10,184,185],{},[13,186,187],{},"Ví dụ (pseudo \u002F PHP):",[44,189,191],{"className":46,"code":190,"language":48,"meta":49,"style":49},"\u002F\u002F vulnerable download\n$file_id = $_GET['file_id'];\n$file = find_file_by_id($file_id);   \u002F\u002F trả về object {owner_id, path}\nreadfile($file->path);               \u002F\u002F NO authorization check!\n",[24,192,193,198,203,208],{"__ignoreMap":49},[53,194,195],{"class":55,"line":56},[53,196,197],{},"\u002F\u002F vulnerable download\n",[53,199,200],{"class":55,"line":62},[53,201,202],{},"$file_id = $_GET['file_id'];\n",[53,204,205],{"class":55,"line":68},[53,206,207],{},"$file = find_file_by_id($file_id);   \u002F\u002F trả về object {owner_id, path}\n",[53,209,210],{"class":55,"line":74},[53,211,212],{},"readfile($file->path);               \u002F\u002F NO authorization check!\n",[10,214,215,217,218,221],{},[13,216,94],{}," attacker thay ",[24,219,220],{},"file_id"," thành ID của người khác để tải file private.",[10,223,224],{},[13,225,104],{},[106,227,228,231,234,241],{},[109,229,230],{},"Tìm các tham số thể hiện id (id, file_id, invoice, order, user_id).",[109,232,233],{},"Thử thay giá trị id (incre\u002Fguess) và xem có access hay không.",[109,235,236,237,240],{},"Kiểm tra JSON APIs: thay ",[24,238,239],{},"user_id"," trong body, hoặc object_id in URL.",[109,242,243],{},"Kiểm tra predictable ids (incremental) dễ dò hơn UUID.",[10,245,246,248],{},[13,247,129],{}," lộ dữ liệu người khác, leak tài liệu, có thể leak PII.",[10,250,251],{},[13,252,135],{},[106,254,255,262,265,268,271],{},[109,256,257,258,261],{},"Luôn check ",[13,259,260],{},"authorization",": verify current_user is owner or has permission on the object.",[109,263,264],{},"Không dùng predictable ids nếu không cần; nhưng chính yếu là authorization check, không masking id.",[109,266,267],{},"Use per-resource ACL checks in backend, centralized authorization logic (avoid ad-hoc).",[109,269,270],{},"Rate-limit and audit access to sensitive endpoints.",[109,272,273,274,278,279,282],{},"Use unguessable references (random UUIDs) ",[275,276,277],"em",{},"as additional"," mitigation but ",[13,280,281],{},"do not rely on it",".",[161,284,286],{"id":285},"_3-rce-remote-code-execution","3) RCE — Remote Code Execution",[10,288,289,291],{},[13,290,15],{}," RCE xảy ra khi attacker có thể khiến server\u002Fthực thể chạy mã (shell command, code) do họ kiểm soát — hậu quả nặng nề: takeover server, pivoting, persistent compromise.",[10,293,294],{},[13,295,296],{},"Cơ chế & các vector phổ biến:",[106,298,299,313,327,333,339,345],{},[109,300,301,304,305,308,309,312],{},[13,302,303],{},"Command Injection",": trực tiếp chèn input vào shell command (e.g., ",[24,306,307],{},"system(\"ping $host\")",") → ",[24,310,311],{},"; rm -rf \u002F"," style.",[109,314,315,318,319,322,323,326],{},[13,316,317],{},"Unsafe eval \u002F template injection \u002F expression language (EL) injection",": dùng ",[24,320,321],{},"eval()","\u002F",[24,324,325],{},"exec()"," hoặc template engine cho phép chạy code từ input.",[109,328,329,332],{},[13,330,331],{},"Deserialization",": insecure deserialization dẫn tới gadget chain → RCE.",[109,334,335,338],{},[13,336,337],{},"File upload + webshell \u002F LFI\u002FRFI chain",": upload file + include\u002Fexcute.",[109,340,341,344],{},[13,342,343],{},"Dependency gadget \u002F insecure libraries"," (e.g., vulnerable image processors, native libs).",[109,346,347,350],{},[13,348,349],{},"SSRF → internal service that executes commands"," (chaining).",[10,352,353],{},[13,354,355],{},"Ví dụ (vulnerable command injection in PHP):",[44,357,359],{"className":46,"code":358,"language":48,"meta":49,"style":49},"\u003C?php\n$ip = $_GET['ip'];\n\u002F\u002F vulnerable: directly concatenated to shell command\n$output = shell_exec(\"ping -c 1 \" . $ip);\necho \"\u003Cpre>$output\u003C\u002Fpre>\";\n?>\n",[24,360,361,365,370,375,380,385],{"__ignoreMap":49},[53,362,363],{"class":55,"line":56},[53,364,59],{},[53,366,367],{"class":55,"line":62},[53,368,369],{},"$ip = $_GET['ip'];\n",[53,371,372],{"class":55,"line":68},[53,373,374],{},"\u002F\u002F vulnerable: directly concatenated to shell command\n",[53,376,377],{"class":55,"line":74},[53,378,379],{},"$output = shell_exec(\"ping -c 1 \" . $ip);\n",[53,381,382],{"class":55,"line":80},[53,383,384],{},"echo \"\u003Cpre>$output\u003C\u002Fpre>\";\n",[53,386,387],{"class":55,"line":86},[53,388,89],{},[10,390,391,393,394,397],{},[13,392,94],{}," attacker gửi ",[24,395,396],{},"8.8.8.8; cat \u002Fetc\u002Fpasswd"," → may execute extra commands (depends on escaping).",[10,399,400],{},[13,401,104],{},[106,403,404,407,413],{},[109,405,406],{},"Tìm code gọi shell, eval, templates, image processors, deserialization points, file upload + include, or endpoints that run system commands.",[109,408,409,410,282],{},"Test with safe lab payloads that trigger observable side effects (timing, output) — ",[13,411,412],{},"only in lab",[109,414,415,416,27,419,27,422,27,425,27,428,431,432,435],{},"Kiểm tra input passed to ",[24,417,418],{},"exec",[24,420,421],{},"system",[24,423,424],{},"popen",[24,426,427],{},"Runtime.exec",[24,429,430],{},"ProcessBuilder",", template ",[24,433,434],{},"{{ }}"," evaluation points.",[10,437,438],{},[13,439,440],{},"Phòng ngừa \u002F fix (defense-in-depth):",[442,443,444,462,468,483,489,495,501,507,513,519],"ol",{},[109,445,446,449,450],{},[13,447,448],{},"Never pass user input to shell commands directly."," Use safe APIs with argument arrays (no shell).",[106,451,452],{},[109,453,454,455,458,459,461],{},"In PHP, use ",[24,456,457],{},"proc_open"," carefully or better libraries. In Java, use ",[24,460,430],{}," with args array and avoid shell parsing.",[109,463,464,467],{},[13,465,466],{},"Escape & validate input strictly."," Prefer allowlist (IP pattern, hostname regex) not blacklist.",[109,469,470,482],{},[13,471,472,473,475,476,475,479,481],{},"Avoid ",[24,474,321],{}," \u002F ",[24,477,478],{},"system()",[24,480,325],{}," when possible."," If unavoidable, sandbox and validate.",[109,484,485,488],{},[13,486,487],{},"Sanitize template engines \u002F use safe template configs."," Disable expression language evaluation from untrusted sources.",[109,490,491,494],{},[13,492,493],{},"Harden deserialization:"," whitelist classes, sign payloads, or avoid native serialization.",[109,496,497,500],{},[13,498,499],{},"Harden file uploads:"," store outside webroot, rename files, validate type, disallow executable extensions.",[109,502,503,506],{},[13,504,505],{},"Run with least privilege:"," web user minimal rights; containerize; limit capabilities.",[109,508,509,512],{},[13,510,511],{},"Egress\u002Fingress controls & monitoring",": prevent outbound C2, monitor processes, use EDR.",[109,514,515,518],{},[13,516,517],{},"Patch & update dependencies"," (image libs, native libs).",[109,520,521,524],{},[13,522,523],{},"Use WAF \u002F RASP"," as mitigation (not substitute).",[526,527,528],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":49,"searchDepth":62,"depth":62,"links":530},[],"cơ chế từng loại, ví dụ vulnerable (PHP\u002FNode), cách dò, chuỗi tấn công có thể dẫn tới RCE và checklist fix nhanh.","md",{"badge":534,"tags":535,"date":537,"dateDisplay":538,"image":539},"Web Security",[536],"Web","2025-06-20","Jun 20, 2025","\u002Fthumbnails\u002Fowasp-top-ten-1000.png",true,"\u002Fposts\u002Fidor-lfi-rce",{"title":5,"description":531},"posts\u002Fidor-lfi-rce","QOTe85DqKC39MVZfYAiLTroG5fHKOmKioO3j_0hdTJc",1787385494442]