+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: local file inclusion question (/showthread.php?tid=5787065)
local file inclusion question - DarkWapOne - Jan 19, 2018
hi there
how can i get a shell uploaded on a website without accessing the proc/self/environ file because every time i change the the path to it i either get an error message or a blank page what should i do to upload a shell to the site
RE: local file inclusion question - [BLANK] - Jan 19, 2018
If you uploaded a php shell to the server through LFI/RFI then seeing a blank white page can mean it is working. Maybe there are other factors at play. The code is wrong? Your reverse connection is not set up correctly etc. We would need a lot more details to help, also we won't help if what you are testing is illegal.
RE: local file inclusion question - DarkWapOne - Jan 20, 2018
(Jan 19, 2018 01:48 PM)EasyGhost Wrote: If you uploaded a php shell to the server through LFI/RFI then seeing a blank white page can mean it is working. Maybe there are other factors at play. The code is wrong? Your reverse connection is not set up correctly etc. We would need a lot more details to help, also we won't help if what you are testing is illegal.thanks for replying
the problem isn't with the shell, its within the proc/self/environ file that i can't access, it gives me a blank page when i try to display the content of it
is there any other way to upload a shell without this file
RE: local file inclusion question - Baud - Jan 21, 2018
Well yes that's a pretty outdated method, it's no surprise it doesn't work. Uploading a shell with LFI relies on injecting malicious code on a vulnerable file and then loading that file to get the shell. There are a few other ways to do it, these are the ones I know assuming we're talking about a Linux machine:
- mail server logs injection: /var/mail/valid_user (you might need some enumeration work to find a valid username)
- SSH logs injection: /var/log/auth.log
- Apache logs injection: /var/log/apache2/access.log
Try loading either of those files, if they load, they could be vulnerable and you can inject malicious code in them. Try them all and post here if you find them.
RE: local file inclusion question - t4ctici4n - Jan 23, 2018
(Jan 19, 2018 03:24 AM)DarkWapOne Wrote: hi there
how can i get a shell uploaded on a website without accessing the proc/self/environ file because every time i change the the path to it i either get an error message or a blank page what should i do to upload a shell to the site
OK contact me , let me see what i can do ..
RE: local file inclusion question - Baud - Jan 23, 2018
(Jan 23, 2018 03:14 AM)t4ctici4n Wrote: OK contact me , let me see what i can do ..
You look like a scammer judging from your other posts.
RE: local file inclusion question - hi_man - Jan 23, 2018
You can try SSH Log injection (it is complicated) if you know the IP of the server then you can get shell on it.
MOre info - http://www.hackingarticles.in/rce-with-lfi-and-ssh-log-poisoning/