Hot answers tagged

6

Start sending a simple PHP file with a command that does not require output, but allows you to determine whether it's been executed or not. Simply run twice the RFI and send from netcat: <?php /* do nothing */ ?> and <?php sleep(10); ?> If the second command has the web site returning the page in a time 10 seconds longer than with the ...


4

The presented mitigation is absolutely insufficient. It’s not just possible to include any file from the current directory but also from any directory depending on the file system (i. e., \.. still works on Windows) or by using an absolute path (e. g., /… on Unix-like systems, or \… on Windows) as well via different protocols/wrappers (e. g., http://…, file:...


4

I don't think this will allow someone to directly include /etc/passwd, but there's still a lot of trouble to be had from this. An attacker might be able to: Trigger a DoS by including the file itself. (Since you're using include, not include_once, it'll recursively keep including the same file.) Include arbitrary scripts on your system, such as copies of ...


4

It can be exploited by log files injection. it might be possible to inject Apache log files, but these files needs root access to open, so it will not be possible to open them via LFI. to solve this problem, we inject temporary Apache log files, which are existed under this path: proc/self/fd/12 or proc/self/fd/14 or proc/<apachi pid>/fd/12 or ...


3

Carpet bombing is a military term - meant to indicate laying a carpet of explosives or incendiaries in order to kill/destroy anything within the target area. Wikipedia says: Carpet bombing is a large aerial bombing done in a progressive manner to inflict damage in every part of a selected area of land. The phrase evokes the image of explosions ...


3

Generally if you're looking to test for RFI the way to approach it is to place a URL that you have control over as the parameter. That way then the URL is accessed you can look in the web server logs to see if you had a request from the server your assessing for that page. As to whether this website is vulnerable, to be honest it's not possible to tell ...


3

On Solaris, you get a process environment with these commands: pargs $$ pargs -e $$ There is no shortcut like /proc/self with Solaris so you need to know the PID of the process, eg.: /proc/$$/psinfo Moreover, only the arguments are visible here, the environment is in /proc/pid/as and I doubt this file to be exploitable with LFI as it is kind of a ...


3

Null Byte Poisoning is pretty old vulnerability, which has been already fixed since 5.3.4 PHP-version. Release Announcement: Paths with NULL in them (foo\0bar.txt) are now considered as invalid (CVE-2006-7243). If you are sure, that your PHP-version is correct, please try to inject some remote resource without NULL-byte character in path, to check, if ...


3

This is most likely a botnet trying the "doors" as Bob has suggested. From time-to-time, vulnerabilities appear in standard software that allows attackers access via supposedly innocuous entry points. If you don't already have it installed, I would recommend something like fail2ban which will automatically ban source IP's that make attempts to get to ...


2

So, The issue was: I was running apache on my localhost to host the exploit and was trying to backconnect to myself. (I realized this after I shelled myself once.) After that, I hosted a one liner reverse shell (thanks to the comments by @Michael) on a different machine and spawned a shell on the target machine.


2

I believe you also need to include in the php.ini the directive of: allow_url_fopen to be set to 1 This allows remote URLs to be loaded using fopen, but considering you're not using fopen, I guess it's not really applicable, but worth a try none the less. You could also try register_globals this variable controls whether arbitrary variables can be injected ...


1

/proc/self/environ contains the environment of the process. In this case, only the CONTEXT_DOCUMENT_ROOT seem to be present (there would be a \0 between the two copies). This would be possible. If your php application isn't run as a CGI, there's no need for the HTTP_ variables to appear there. The other SAPIs (such as FastCGI or an apache module) receive ...


1

This seems like an illogical question with a wrong mindset. (No offence!) I suggest to prevent LFI attacks at all times. Hiding files is security by obscurity and this should be prevented at all times. Proper permission should be set to the mentioned folders so the user www-data or apache can't access them (with newer operating systems this should the case)...


1

XSS is a client side attack, but it can sometimes be used to leverage a bigger attack against the server. Say there was a page that the admin user only had access to as the first thing it does was to check the user has appropriate permissions. e.g. http://www.example.com/admin/delete_user.php?id=3&lang=en It might be that the lang parameter points to ...


1

XSS is an attack against the client, not the server. The only way an attacker could turn this against the server is if the victim has special privileges (like an administrator account).


1

You should read LFI to RCE. You need to be able to upload a file or populate a log file with a PHP tag and then include this file using the LFI vulnerability.



Only top voted, non community-wiki answers of a minimum length are eligible