+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Shell upload via tamperdata/gimp editor (/showthread.php?tid=1808069)
Shell upload via tamperdata/gimp editor - wargames - Oct 10, 2011
Is there any other method to upload shell apart from tamper data, if jpg uploads are allowed,
shell.jpg.php , shell.jpg;.php isn't working,
did any one tried with gimp editor ?
* - dhrubo11 - Oct 10, 2011
i tried many times but it's not work ...
* - wargames - Oct 10, 2011
yea i did tried like hell lot of times but on most of the sites it won't workout..
* - cheatson - Oct 10, 2011
(Oct 10, 2011 10:07 AM)wargames Wrote: Is there any other method to upload shell apart from tamper data, if jpg uploads are allowed,
shell.jpg.php , shell.jpg;.php isn't working,
did any one tried with gimp editor ?
Uploading shells via image uploaders is pretty low percentage in my experience.
It depends whats catching, whats the error?
To try and bypass all known filters, I just try this these days:
Create an image in paint within the dimensions allowed by the site. Edit it with edjpgcom and enter your shell code into the image header. Upload it using whatever.jpg;.pHp (uppercase H on purpose!). If that doesn't work, try tamper data. If that doesn't work it is most likely guarded by a .htaccess file in the same directory that denies .php execution/upload.
Only way around it is to overwrite the .htaccess file by uploading a .htaccess of your own (php by default overwrites changes so should work unless the serverside checks are set to filter this).
Inside your .htaccess alot of people just add the neccesary lines to allow php files, but what often happens is that there is some other mechanism to prevent the php file running. What you can do is set the .htaccess to treat .htm files as files to be passed to the php processor, that way it kind of tricks it into running the shell as you upload shell.htm (or anyother extension you like that doesnt get filtered), and voila.
add the lines below to get this effect:
AddType application/x-httpd-php .htm .html
AddHandler x-httpd-php .htm .html
If none of that works, then meh 👹
* - happyhaxor - Oct 10, 2011
Whoa awesome :/ I need a tut for rooting and attackin IIS 6.0 any one can help ?
* - wargames - Oct 15, 2011
Thanks cheatson
yes will try will overwriting .htaccess