1

I am pentesting a PHP website running on Apache in a Ubuntu server.

I found a vulnerability that allows me to write files to the target system. I know it's possible to write a php shell to the HTTP root directory and get RCE this way, but in my case It does not seem possible. The web server is running as the www-data user, who does not have permissions to write anywhere inside the HTTP root directory. I did successfully write files only to /tmp/ and /dev/shm/ .

Is there any technique that may help me get a RCE out of this vulnerability? Or is this the most I can do with it?

|improve this question
  • 2
    You'll need something that you can make look outside the webroot in some way - a script that reads files from a path you can control, something that you can change the config file path for, etc. I don't see how it could be exploited on its own, but there are all sorts of possible other issues that also can't be exploited on their own but can in combination with being able to write somewhere to the disk. In a real-world attack or very red-team scenario, I guess you could also write stuff there to 'prove' to an admin that you already have access for social engineering purposes. – Silver Oct 1 '19 at 23:51
0

Is there any technique that may help me get a RCE out of this vulnerability? Or is this the most I can do with it?

No,in and of itself you cant exploit this for an RCE.You will simply be able to smuggle shells using this way and wont be able to execute them.You will have to chain this vulnerability with another one to gain RCE.A vulnerability like directory traversal could help you gain RCE in this case.

ALTHOUGH There have been cases where web application use vulnerable libraries which takes what the user uploaded and preform actions on it.If the application uses such a vulnerable upload then that could also be leveraged to perform other actions,sometimes ever RCE or Sql injection.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.