I am penetration testing on dummy website and i succesfully uploaded Backdoor but later i found that PHP safe-mode is enable so can we bypass PHP safe-mode?
I am penetration testing on dummy website and i succesfully uploaded Backdoor but later i found that PHP safe-mode is enable so can we bypass PHP safe-mode?
Certainly yes, see if you can upload the PHP.ini on the same path as the shell file located.
Upload php.ini with following settings.
There one more way where you can try - Upload .htaccess file with "php_value safe_mode off" (without quote)Code:safe_mode = Off
I hope this helps you.
Garage4Hackers bugs for the community , of the community
We provide IT
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
:
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
|
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
|
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
|
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
I'm assuming that you're not doing anything illegal, so:
- can you read the (www/nobody=uid) files inside the filesystem?
for example: php.ini in the main webserver directory?
- is there any chroot/jail/can-you-check-it?
- ps aux please (maybe there is an old mysql if you're telling that this is a 'dummy' websrv)
- back to reading files, grep them for juicy info like passwords/hostaddresses/logins/paths.
good luck.
I'm assuming that you're not doing anything illegal, so:
- can you read the (www/nobody=uid) files inside the filesystem?
for example: php.ini in the main webserver directory?
- is there any chroot/jail/can-you-check-it?
- ps aux please (maybe there is an old mysql if you're telling that this is a 'dummy' websrv)
- back to reading files, grep them for juicy info like passwords/hostaddresses/logins/paths.
- let us know more about the backdoor you used. is it yours/publicly available (so we can check the source)?
good luck.
hi, I see the are few errors on the forum. fyi.
Hi enlil,
So what error do you see?
Thanks
[*] To follow the path: look to the master, follow the master, walk with the master, see through the master,
------> become the master!!! <------
[*] Everyone has a will to WIN but very few have the will to prepare to WIN
[*] Invest yourself in everything you do, there's fun in being serious