[Jon Snow]

i.php is my shell.
https://i.imgur.com/MP04Gvv.png

I want to read flag.php
https://i.imgur.com/7ttn4LU.png

How can I do that? If I try to access it directly, I get Permision denied (/flag.txt)!

Thanks a lot!

[iHacker-n00b]

Did You Try To Create Symlink or Hardlink?

[Jon Snow]

Did You Try To Create Symlink or Hardlink?

Just did and it doesn't work...
Any other ideas?

[iHacker-n00b]

Just did and it doesn't work...
Any other ideas?

Yea How about trying privilege escalation?? 🤭 http://www.exploit-db.com/exploits/33824/

[Sky]

You could try using this code;

PHP Code


<?
include /path/to/flag.txt;
?>

Then view the page source, I've used this trick to read a few config files before.

You could also try copying the contents to a new file;

PHP Code


<?
echo copy("flag.txt","flagnew.txt");
?>

~Sky 🤝