0

I managed to upload a PHP shell using an upload form with some tweaking. No such restrictions except it renames the uploaded file to md5. But when I tried to execute the shell, It shows a 500 error. I am able to view or download all other files such as HTML, JS, JPG etc. On digging further, I found that there is a .htaccess file with the content below. Is there a possibility that PHP is not executing because of the permissions? Is there a way to execute PHP or gain shell using any other ways?

Options -Indexes

<files .htaccess>
  order allow,deny
  deny from all
</files>

#Add all file you want to protect...
<FilesMatch "\.(htaccess|htpasswd|ini|zip|rar|mp3|phps|fla|psd|log|sh|php)$">
  Order Allow,Deny
  Deny from all
</FilesMatch>

It is confirmed that the server has PHP Installed and executes PHP on all other directories except uploads folder.

Steps already performed:

  1. Tried uploading shell with different extensions and combination of lower/upper case like PhP, PHp. phtml extension also gets uploaded but same issue of internal server error while executing phtml too.

  2. Checked uploading and viewing HTML on browser, works fine.

  3. Tried with a simple PHP echo. Not working.

5
  • 1
    A 500 error is not a 403 error. In other words, it's not a permissions issue; the server is trying (and failing) to execute that PHP file.
    – Ghedipunk
    Sep 20, 2019 at 17:44
  • If you got SSH access can you do ls -l to show us some of the permissions? Feel free to edit filenames for privacy (not types obviously) Sep 20, 2019 at 18:36
  • How would he get ssh access?
    – yeah_well
    Sep 20, 2019 at 19:13
  • Is the filename renamed to md5.php? or just md5
    – yeah_well
    Sep 20, 2019 at 19:13
  • Renamed to md5.extension. (md5.php, md5.jpg) Sep 20, 2019 at 19:15

2 Answers 2

2

If the server is refusing to execute a php script on the uploads folder but runs php scripts elsewhere, it sounds like the server is working as it should. You'll need to use one of those other directories to pop and explore.

2

I can see two different possibilities:

  • There is an actual error in your PHP code that leads to the 500 response. The simple echo test should check for this. An empty file would be an even better test.

  • Even though PHP is only blocked in a certain folder, the configuration does not have to be in that folders .htaccess. An .htaccess file in some parent folder or settings in httpd.conf could be blocking PHP execution in the uploads folder.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .