---
title: "Slort — RFI via PHP allow_url_include + Writable Scheduled Task Binary to Administrator | OffSec PG Play"
url: https://daily.dev/posts/slort-rfi-via-php-allow-url-include-writable-scheduled-task-binary-to-administrator-offsec-pg--f3vqthu69
source_url: https://infosecwriteups.com/slort-rfi-via-php-allow-url-include-writable-scheduled-task-binary-to-administrator-offsec-pg-ac72c40761ae
type: article
source: "InfoSec Write-ups"
published: 2026-06-18T07:55:44.150Z
updated: 2026-06-18T07:56:11.226Z
tags: ["security", "windows", "php"]
reading_time: 16
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Slort — RFI via PHP allow_url_include + Writable Scheduled Task Binary to Administrator | OffSec PG Play

**[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 16 min read · 0 upvotes · 0 comments

## Summary

A walkthrough of the Slort machine from OffSec Proving Grounds Play, demonstrating a two-stage attack chain on a Windows target. The initial foothold exploits PHP's allow_url_include directive enabled on an old XAMPP installation: the ?page= GET parameter is passed unsanitised into include(), allowing a remote URL to be fetched and executed as server-side PHP, yielding a Meterpreter shell as a low-privilege user. Privilege escalation is achieved by discovering C:\Backup\TFTP.EXE — a binary invoked every five minutes by a scheduled task running as Administrator — has full write permissions for BUILTIN\Users. Replacing the binary with a Meterpreter payload and waiting for the scheduler delivers an Administrator session. The writeup covers full reconnaissance, web enumeration with ffuf, LFI/RFI confirmation, post-exploitation enumeration, and detailed mitigations for all three critical vulnerabilities.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://infosecwriteups.com/slort-rfi-via-php-allow-url-include-writable-scheduled-task-binary-to-administrator-offsec-pg-ac72c40761ae>

## Similar posts on daily.dev

- [Chaining SSRF and LFI to Achieve Root Access on a Major Telecom Server](https://daily.dev/posts/chaining-ssrf-and-lfi-to-achieve-root-access-on-a-major-telecom-server-nef9xcede) · InfoSec Write-ups · 0 upvotes · 0 comments
- [SAR — CVE-2019–12454 in sar2html and a Writable Cron Script That Got Me Root \| OffSec PG](https://daily.dev/posts/sar-cve-2019-12454-in-sar2html-and-a-writable-cron-script-that-got-me-root-offsec-pg-oplmr4t3q) · InfoSec Write-ups · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#windows](https://daily.dev/tags/windows), [#php](https://daily.dev/tags/php)

[View this post on daily.dev](https://daily.dev/posts/slort-rfi-via-php-allow-url-include-writable-scheduled-task-binary-to-administrator-offsec-pg--f3vqthu69)