https://coreyfarley.com/tags/lfi/ Recent content in LFI on Corey Farley Hugo en-us Tue, 03 Nov 2026 00:00:00 +0000 https://coreyfarley.com/posts/fulcrum-htb/ Tue, 03 Nov 2026 00:00:00 +0000 https://coreyfarley.com/posts/fulcrum-htb/ <p><code>Fulcrum</code> is a machine that presents an unusually wide attack surface up front: six open ports spanning multiple nginx-fronted web apps, a phpMyAdmin instance, and a JSON API advertising itself as <code>Fulcrum-API Beta</code>. The initial foothold centers on the application listening on port 4, which exposes an <code>index.php?page=</code> parameter and a file upload endpoint.</p> <h2 id="enumeration">Enumeration</h2> <p>Full port nmap scan first:</p> <pre tabindex="0"><code>┌──(corey㉿kali)-[~/htb/Fulcrum] └─$ nmap 10.129.136.254 -sS -p- -T4 Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-03 05:03 -0500 Nmap scan report for 10.129.136.254 Host is up (0.046s latency). Not shown: 65529 closed tcp ports (reset) PORT STATE SERVICE 4/tcp open unknown 22/tcp open ssh 80/tcp open http 88/tcp open kerberos-sec 9999/tcp open abyss 56423/tcp open unknown </code></pre><p>Now aggressive on the present services:</p> https://coreyfarley.com/posts/reset-htb/ Mon, 26 Oct 2026 00:00:00 +0000 https://coreyfarley.com/posts/reset-htb/ An easy-difficulty Linux box chaining an insecure password reset into admin access, an LFI that becomes RCE through Apache log poisoning, lateral movement by abusing BSD r-services host-based trust, and a root shell via a leaked sudo password and nano&rsquo;s command execution.