1

Is it possible to override parent folder .htaccess rules with child php.ini or some other file except .htaccess? What I have is:

/var/www/site/static/.htaccess
/var/www/site/static/abc/
/var/www/site/static/abc/def/(I have access to this)

I have access to def folder in above structure, can I override parent .htaccess rules which blocks all executable files like php, pl, py, asp, etc? How can I enable rules to execute php files in this directory without creating .htaccess?

0

No you cannot. When a .htaccess file blocks the execution of php, your php.ini won't be even read. Your problem is not the php interpreter, but the webserver config. And as you say you cannot create an own .htaccess file, you cannot override the config.

  • any comment on the other answer's suggestion? are they wrong? – schroeder Oct 12 '17 at 13:53
  • No, they are not. IF you are allowed to create a .htaccess file in your directory, you possibly can override some things. But this can be disabled in the parent .htaccess file or the webserver config. And when somebody tries to disallow scripts, they probably made sure you cannot just override the limit. – allo Oct 12 '17 at 14:00
1

Yes, you can override parent .htaccess with a .htaccess file of your own. You can execute php/etc from within the .htaccess file itself. Take a look at my htshells project for some examples: https://github.com/wireghoul/htshells/

  • I am asking to override parent .htaccess without creating .htaccess as it's disallowed – MagExt Jul 14 '17 at 5:40
  • You have a few options, get lucky and they have missed a file ext. Otherwise bug chain file upload + lfi. – wireghoul Jul 14 '17 at 6:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.