To do List
- LFI + automated scanning to find folders/files, payloads
- Basic bypasses
- PHP filters to get base64 data
- PHP wrappers for remote code execution
- RFI using http, ftp, smb
- LFI if we can upload a file
- Log poisoning if there is a PHP session id, or apache/nginx
Assessment:
- page parameter was returning base64 encoded value of the index/contact/about pages.
- index page had a php code that wasnt visible in normal source code.
- this had a link to an ilf_admin/index.php page
- the admin page had a log parameter that was LFI injectable.
- found /../../../../../etc/passwd
- since nginx server, we got the access.log for nginx at /var/log/nginx/access.log
- tried log poisoning by modifying the User-Agent header and that was possible.
- Added the php webshell to the User-Agent and sent the request.
- Now, in the first try of accessing the logs, enter the &cmd=id part to not mess the log file.
- now, we have RCE.