PHP safe-mode bypass?

[codeur]

I am penetration testing on dummy website and i succesfully uploaded Backdoor but later i found that PHP safe-mode is enable so can we bypass PHP safe-mode?

[[s]]

Certainly yes, see if you can upload the PHP.ini on the same path as the shell file located.

Upload php.ini with following settings.

safe_mode = Off

There one more way where you can try - Upload .htaccess file with "php_value safe_mode off" (without quote)

I hope this helps you.

[codeur]

Certainly yes, see if you can upload the PHP.ini on the same path as the shell file located.

Upload php.ini with following settings.

safe_mode = Off

There one more way where you can try - Upload .htaccess file with "php_value safe_mode off" (without quote)

I hope this helps you.

Thank you for your reply.
I tried both method but nothing happened.

[enlil]

I'm assuming that you're not doing anything illegal, so:
- can you read the (www/nobody=uid) files inside the filesystem?
for example: php.ini in the main webserver directory?

- is there any chroot/jail/can-you-check-it?

- ps aux please (maybe there is an old mysql if you're telling that this is a 'dummy' websrv)

- back to reading files, grep them for juicy info like passwords/hostaddresses/logins/paths.

good luck.

[enlil]

I'm assuming that you're not doing anything illegal, so:
- can you read the (www/nobody=uid) files inside the filesystem?
for example: php.ini in the main webserver directory?

- is there any chroot/jail/can-you-check-it?

- ps aux please (maybe there is an old mysql if you're telling that this is a 'dummy' websrv)

- back to reading files, grep them for juicy info like passwords/hostaddresses/logins/paths.

- let us know more about the backdoor you used. is it yours/publicly available (so we can check the source)?

good luck.

[enlil]

hi, I see the are few errors on the forum. fyi.

[b0nd]

Hi enlil,

So what error do you see?

Thanks