6 replies to this topic

[AgentSmith15]

Hi I am doing a pen test for my client and I have found that some folders on his website have write permissions enabled. I was wondering if it is possible to create a PHP or ASP file that will grab some of the other PHP files and send them to me as proof that there is in fact also a source script vulnerability too.

[AgentSmith15]

If this is the wrong section can a mod please move it to where it belongs.

[setthesun]

Of course you can write,

Check out ready to go file manager scripts.

Secondly for ASP try FSO, for PHP fopen() or otehr similiar ones.

Finally if target PHP version is vulnerable you can bypass openbasedir restrictions which means you can copy almost any file ! (like /etc/passwd)

or any other critical configuration or data file.

[AgentSmith15]

Hmm I thought I would have this down with net cat but I didn't.

I am trying to use PUT with netcat and I seem to messing up somehow.


I am trying to do something like

nc -vv www.client.com 80 <file.txt<

But I do not know if I am doing this correctly. What I need to do is use netcat to write this script to my clients server.

[AgentSmith15]

Eh, you might wanna send the content manually.
ie.

"POST <path> HTTP/1.1\n"
		"Host: <host>\n"
		"Content-type: application/x-www-form-urlencoded\n"
		"Content-Length: <length of data to post>\n\n"

		"data=<data to post>\n\n"

Thanks I will try this.

[setthesun]

I think I got it wrong,

How do you know that folder have write permissions?