> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/snookums/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/snookums/exploitation.md).

# Exploitation

{% embed url="<https://www.exploit-db.com/exploits/48424>" %}

The <http://192.168.135.58/image.php>?<mark style="color:red;">img=</mark> parameter is vulnerable to Remote File Inclusion, which allows an attacker to make the website request a file that it is not in the local webserver. This means that the attacker is able to generate a reverse php shell, and get Remote Code Execution.&#x20;

![](https://3586177881-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpnAsCoAs8vkn5abiWhHv%2Fuploads%2Fwb2pi6QA9qrfW2JSerIz%2F2022-08-08_13-08.png?alt=media\&token=bf92dc48-fb3d-43f3-ade4-8a7872366e41)

As we can see the applicaiton requested the said file once we specified it in the url.&#x20;