All Questions

Tagged with
Filter by
Sorted by
Tagged with
1
vote
1answer
57 views

Bash wildcards - Manipulate globbing to delete arbitrary files

I am currently auditing a plugin and have the following situation (simplified for example purposes): <?php $post_id = false; $absolute_path = "/var/www/html/wordpress/cache"; $extension = ".min....
3
votes
2answers
3k views

Turned on cgi.fix_pathinfo still “dangerous” in Nginx?

In this article in digitalocean.com Justin Ellingwood recommends to turn off cgi.fix_pathinfo: Inside, we need to find a section that configures the cgi.fix_pathinfo behavior. It will be ...
0
votes
1answer
411 views

Does having /sbin/nologin mean I cannot start the /bin/sh executable?

While practicing exploitation on a lab, I managed to get the ability to execute php code which allowed me to execute system commands through shell_exec on a web server. The apache user has /sbin/...
2
votes
1answer
323 views

Is this PHP TOTP (time based one time password) idea sound?

Disclaimer: I am not very familiar with safety techniques in general. The problem: Quickly create lots of small files in server from a bash script. I used to use scp (secure copy) in order to create ...
3
votes
1answer
959 views

Shellshock and PHP fastcgi

I understand that running apache/mod_php is safe, but I havn't heard about the case of running php in fastcgi mode (via nginx/php5-fpm), so, anyone can confirm this is also safe?
7
votes
5answers
11k views

Shellshock attack scenario exploiting php

I've seen attack scenarios involving using wget on cgi-scripts, but how about a scenario exploiting a web server php script that issues an exec() or system() call to a bash script? As far as I can ...
3
votes
1answer
300 views

Does FCGId use environment variables? (Or is it a possible attack vector for CVE-2014-6271/7169?)

According to Red Hat httpd (attack vector): CGI scripts are likely affected by this issue: when a CGI script is run by the web server, it uses environment variables to pass data to the ...