0

I am conducting a pentest where I got stuck on the following problem:

I found a LFI in a php file. I am trying to exploit it and to get a shell or any further usage out of it but until now without any success. I tried

  • to read log files (apache log files, mail log files, mysql log files, ssh log files, etc.) but none of them were readable (probably due to the missing permissions)
  • I tried .ssh/authorized_keys etc. but it is disabled as per sshd config file
  • I tried all possible files on LFI I could find on the Internet and did get some config files but I could not extract any useful information on how to proceed
  • The only thing I could recover are 2 user names via the /etc/passwd file

Other information I know:

  • the server is running a mysql database, I do have the db username, db password and database name, but how can i further exploit it if I cannot ssh on the server due to missing credentials?
  • the server has SSH running

Any other ideas how I could proceed?

Improve this question
3
  • 3
    without knowing a lot more about the target, I'm not sure anyone can help - we'll all be guessing
    – schroeder ♦
    Commented Jul 1, 2017 at 16:19
  • 2
    I agree with the comment above. That said, first thing I would check is whether or not the mysql db is accessible on port 80 via phpmyadmin like software. You could also use telnet to check that the mysql is in fact running on its default port 3306 and whether it's being filtered or not. All I'm saying is that with db credentials already in your possession, you should look for a more direct approach first!
    – user633551
    Commented Jul 2, 2017 at 15:54
  • If you only got 2 usernames via /etc/passwd, it is quite possible the web server is running in a jail/chroot/container environment...
    – jcaron
    Commented Aug 6, 2019 at 14:06

1 Answer 1

Reset to default
1

First, determine if it is a file include or just a traversal. An easy way to do this is to include a php file (you can usually work out a relative path to an index.php file). If it shows you the php source code then it's traversal and will not result in code execution. Otherwise there are some options you haven't mentioned, such as:

  • /proc/self/environ
  • /proc/self/fd/1 (2,3,etc)
  • php session files (read php.ini for path)
  • temporary files uploaded via a POST request (brute force path or leak via php info)
  • php streams/wrappers

If it only reads files then leak application source to find other flaws.

Hope this helps.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .