So I have this challenge in pentesting to get a shell on a vulnerable webapp. I am an authenticated user and I know that the vulnerable app is
kcfinder-2.51 which is a plugin for
I am trying to upload weevely shell, but the problem is that the server is configured to redirect everything to 404-page if it's a directory or if it's a wrong file.
Another problem is that the upload directory is unique to every user even a non-authenticated user has a different upload directory.
- How do I know which upload directory the shell is uploaded on?
- And if I upload a
.htaccessfile in that directory can I enable directory listing or change the config?