1

Hi need some help here.

I am trying to exploit an unsanitized file upload with a PHP backdoor. Basically the file uploads successfully and I can see my backdoor inside the web applications /images/ directory but when I click on the file to execute it I am give an error stating 'permission denied'. (This is because only admin logins can access it).

Is there a way of uploading the file to another directory using a file inclusion vulnerability, so that my user can execute the file? I've search Google etc. but all examples and tutorials involve being able to access the file and execute it with normal privileges.

Note: This is a Web application I have permission to test.

Thanks

  • have you tried /tmp/ directory? You have to be more spesific, what is the system etc... try to find a place with 777 permissions – cengizUzun Sep 3 '14 at 13:58
  • My Nessus returned : CGI scripts that fail to adequately sanitize request strings and are affected by directory traversal or local file inclusion vulnerabilities. /application/upload?description=&name=&email=&uploadfield=../../../../.. /../../../../../tmp When I try to traverse through the files like this I get denied permission again! Is it possible to do File inclusion to a specific directory that I can access (something like piping the file into a directory). The application is an apache server 2.2.22 running php 5.4.4 – user54897 Sep 3 '14 at 14:09
  • How can you click the file as an attacker? Why not upload a php file? – user10008 Sep 3 '14 at 15:11
  • @user1008 I have uploaded a PHP backdoor file but I need to execute the code inside to get a reverse_tcp connection. I can find the file on the server but I'm denied permission when I click on it – user54897 Sep 3 '14 at 15:24
  • What is the underlying OS on the server? This information can be useful. – lzam Sep 4 '14 at 2:21
2

It really depends on the upload function and how it is designed. Have you tried looking at the request? Sometimes applications include a 'directory' variable, or even parse one sometimes when it's not there. Is it a custom application or one that you can download trial for?

Also, does the application support other types of server side code?

Here is a video on "Java code smuggling" also known as GIFAR (GIF + JAR): https://www.youtube.com/watch?v=5TgfKKX7uSQ

Finally, if the site supports .htaccess files you may be able to upload a backdoor that way: https://github.com/wireghoul/htshells

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy