Below are rough notes on a recent HTB machine where a Local File Inclusion (LFI) led to a Remote Code Execution and access to the machine.
nmap returned a lot of open ports, running a directory browser using OWASP ZAP turned up multiple webapps. One app kindly included it's version number on the page which made searching for known exploits very easy.
