During a penetration test, I came across an endpoint which lets me include local files and I can read
/etc/passwd. However I don't have permissions to read
The endpoint looks like:
(Apache webserver running php on Ubuntu)
The payload above returns the following error message:
Warning: require_once(../../../../var/log/messages) [function.require-once]: failed to open stream: Permission denied in /var/www/classes/file.php on line 4
I can't read log files because I get
permission denied message when I try accessing
/var/log/messages ,( because of which log poisoning seems unlikely, in this case.)
The answer to this questions suggest looking into ssh logs, which isn't readable either.
Any ideas how this can be leveraged to RCE?