2

So I have this challenge in pentesting to get a shell on a vulnerable webapp. I am an authenticated user and I know that the vulnerable app is kcfinder-2.51 which is a plugin for ckeditor_3.6.4.

I am trying to upload weevely shell, but the problem is that the server is configured to redirect everything to 404-page if it's a directory or if it's a wrong file.

Another problem is that the upload directory is unique to every user even a non-authenticated user has a different upload directory.

  • How do I know which upload directory the shell is uploaded on?
  • And if I upload a .htaccess file in that directory can I enable directory listing or change the config?
0

3 Answers 3

0

You can do much more than enabling directory indexes with a .htaccess file. Take a look at my htshells project: https://github.com/wireghoul/htshells/

0

It sounds like you're trying to find the correct url that will allow you to upload your payload, but you do not know the correct path.

In this case I would recommend a tool such a dirbuster. It will brute force directories (and file extensions) according to any wordlist you feed it (you can add the usernames/custom variables to a typical wordlist to be more accurate). You can also configure the tool to recursively check for files/directories.

p.s. This tool is built-in on Kali and has custom wordlists already loaded on Kali as well.

0

I have found the upload url, which was in the browse.php html page source

<script type="text/javascript">
....
browser.uploadURL = "http://host.com/files";
....
</script>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .