[Zoidberg]

I was wondering if, given allowing server configuration and unpatched kernel, then it might be possible to get root from a file upload attack vector. Has anyone thought about this? I've got a good experience with PHP but not in terms of something like this.

Or even, if you can upload file to server but don't have root access, given improper permissions php could unload a zip with the payload, then execute a script that gains root and from there it could do whatever the fuck it wanted to.

I'm simply wondering if this is possible, I have no intent on doing this in the wild

[Phizo]

Yes of course you can. Why would you expect otherwise?

[Malicious Intent]

Check this thread mate https://hackforums.net/showthread.php?tid=5464754
It was a challange by Royalty. The site is down now but if you check the last posts i belive exploit.c posted the php this site was sporting.
If it's not there anymore hit me up, I have a copy of that for training purposes.

[ThatGuy126]

Might want to make sure you have written permission and check to make sure your IT teacher has the ability to give such permission.

---

sorry im in the wrong thread. drinking...