 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 135
 Members: 0
 Total: 135
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
What are useful shell commands? |
|
 Posted: Wed Oct 13, 2004 1:56 am |
 |
|
| peteblackhouse |
| Beginner |
 |
|
| Joined: Oct 13, 2004 |
| Posts: 2 |
|
|
|
 |
|
 |
|
Hmm, nothing in this forum. Shame, 'cos I'm interested!
Suppose I get a method of running a shell command on a PHP/*NIX server (remote inclusion or similar). What can I usefully do?
I was just experimenting on my local Linux machine and concluded that the 'wwwrun' user (which the web server runs as) has access to very few files on a standard system. It can't even overwrite the files in a public_html directory to achieve a simple defacement.
Maybe if the server is running a CMS or something, more is possible? Failing that, what sorts of shell commands can I inject which might prove useful? |
|
|
|
|
|
yes |
|
| Posted: Thu Nov 11, 2004 12:21 pm |
|
|
| ReFleX |
| Active user |
|
|
| Joined: Nov 05, 2004 |
| Posts: 39 |
| Location: ARGENTINA! |
|
|
|
|
|
|
I'm also experimenting on my linux box, making remote file inclusion And the executing commands with System() but I cant do anything Interested, 'wwwuser' only have rights to read some files (depends on the config of webserver and the web user).
I were thinking about opening a shell or maybe put something to gain more access but wwwuser dont have the rights to 'blind' ports (usually nobody can, only root).
If anyone know more about this issue, how to gain more access or something else ... just post.
P/D: Sorry about my english .... i'm from argentina  |
|
|
|
|
|
Re: yes |
|
| Posted: Mon Mar 07, 2005 6:39 am |
|
|
| y3dips |
| Valuable expert |
 |
|
| Joined: Feb 25, 2005 |
| Posts: 281 |
| Location: Indonesia |
|
|
|
|
|
|
| ReFleX wrote: | I'm also experimenting on my linux box, making remote file inclusion And the executing commands with System() but I cant do anything Interested, 'wwwuser' only have rights to read some files (depends on the config of webserver and the web user).
I were thinking about opening a shell or maybe put something to gain more access but wwwuser dont have the rights to 'blind' ports (usually nobody can, only root).
If anyone know more about this issue, how to gain more access or something else ... just post.
P/D: Sorry about my english .... i'm from argentina |
u need to find a directory with nobody allow to write (with permission 777) so u can put a backdoor , for example /tmp directory
but still with nobody/apache access, but u can do some local exploit to gain root.  |
|
_________________
IO::y3dips->new(http://clog.ammar.web.id); |
|
|
|
|
www.waraxe.us Forum Index -> Shell commands injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
