Hot answers tagged

5

Solution: upload the file as hidden, for example: .shell.php and call the file directly.


3

Per https://www.php.net/manual/en/function.str-shuffle.php, str_shuffle uses PHP's internal PRNG, which is an implementation of Mersenne Twister (see http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/emt.html or https://en.wikipedia.org/wiki/Mersenne_Twister). According to Wikipedia, the standard Mersenne Twister implementation requires observing 624 ...


2

Try putting the PHP file in a subdirectory and then zip it with the sub directory, so that when the zip is unpacked it would end up somewhere like: uploads/sub/file.php This won't match the delete command. Presumably you will still be able to run the PHP file in a sub directory.


2

I found out the issue is that /etc/hostname has a newline at the end. Apparently, while Java applications have no problem with this (as shown in the article), PHP does not accept newlines in URIs. I confirmed this by creating a file which doesn't contain a newline. I was able to send it successfully. In fact, you can use the php:// protocol to convert the ...


2

I Found the issue here. I was using msfvenom payload @ php/meterpreter_reverse_tcp but my handler was php/meterpreter/reverse_tcp when I changed it to match (php/meterpreter_reverse_tcp) exactly then my session was established.


1

The language/database framework on the server side is the best indicator on whether or you will be able to use stacked queries. If you can use stacked queries (executing multiple statements in one query: select * from users;drop table users;) it may be wiser to insert a user of your own, rather than altering an existing user. If stacked queries are not ...


Only top voted, non community-wiki answers of a minimum length are eligible