I am pentesting a PHP website running on Apache in a Ubuntu server.
I found a vulnerability that allows me to write files to the target system.
I know it's possible to write a php shell to the HTTP root directory and get RCE this way, but in my case It does not seem possible. The web server is running as the www-data
user, who does not have permissions to write anywhere inside the HTTP root directory. I did successfully write files only to /tmp/
and /dev/shm/
.
Is there any technique that may help me get a RCE out of this vulnerability? Or is this the most I can do with it?