0

I need some serious help. I managed to upload a PHP shell using an upload form with some tweaking. No such restrictions except it renames the uploaded file to md5.But when I tried to execute the shell, It shows a 500 error. I am able to view or download all other files such as HTML, JS, JPG etc. On digging further, i found that there is a HTACCESS file with the content below. Is there a possibility that php is not executing because of the permissions? Is there a way to execute php or gain shell using any other ways?

Options -Indexes

<files .htaccess>
  order allow,deny
  deny from all
</files>

#Add all file you want to protect...
<FilesMatch "\.(htaccess|htpasswd|ini|zip|rar|mp3|phps|fla|psd|log|sh|php)$">
  Order Allow,Deny
  Deny from all
</FilesMatch>

It is confirmed that the server has PHP Installed and executes php on all other directories except uploads folder.

Steps already performed:

  1. Tried uploading shell with different extensions and combination of Lower/Upper case like PhP, PHp. phtml extension also gets uploaded but same issue of internal server error while executing phtml too.

  2. Checked uploading and viewing HTML on browser, works fine.

  3. Tried with a simple php echo. Not working.

  • A 500 error is not a 403 error. In other words, it's not a permissions issue; the server is trying (and failing) to execute that PHP file. – Ghedipunk Sep 20 at 17:44
  • If you got SSH access can you do ls -l to show us some of the permissions? Feel free to edit filenames for privacy (not types obviously) – I'm a TI calculator Sep 20 at 18:36
  • How would he get ssh access? – Vipul Nair Sep 20 at 19:13
  • Is the filename renamed to md5.php? or just md5 – Vipul Nair Sep 20 at 19:13
  • Renamed to md5.extension. (md5.php, md5.jpg) – Marcus Adeao Sep 20 at 19:15
0

If the server is refusing to execute a php script on the uploads folder but runs php scripts elsewhere, it sounds like the server is working as it should. You'll need to use one of those other directories to pop and explore.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.