All geek questions in one place

Using a directory traversal attack to execute commands

Is there a way to execute commands using directory traversal attacks?

For example, I am accessing a server file etc/passwdlike this

http://server.com/..%01/..%01/..%01//etc/passwd

Is there a way to run a command? How...

http://server.com/..%01/..%01/..%01//ls

..... and get a conclusion?

To be clear here, I found that on our server company. I want to increase the level of risk (or bonus points for me) by proving that it can give an attacker full access to the system.

+3
source share
6 answers

/etc/passwd , , , .

, /etc/passwd -, ( ) , popen, exec, system, shell_exec , .

+1

Chroot Linux ( FreeBSD). - SELinux Apache SELinux:

run_init /etc/init.d/httpd restart

, ​​ mod_security.

+2

- -, , , ls ( , ) , ls .

, , .

0

# 2: , . , , gAMBOOKa , Apache Fedora, , :

  • Apache, , Apache Fedora .
  • Fedora, , , Apache .
  • , httpd.conf .
  • passwd, Apache /chrooted, , passwd, /chrooted... , , VMWARE , Apache/Fedora, - httpd VMWare , , . chroot/sandbox ...
  • , , , , , -, sandbox/chrooted - , ...

, , , .

0

If you can already view etc / passwd, then the server should be poorly configured ... if you really want to execute commands, you need to know that the PHP script works on the server, is there any system () so that you can pass commands via url .. for example: url? command = ls try to view .htaccess files .... this might do the trick ..

0
source

Source: https://habr.com/ru/post/1732776/

More articles:


All Articles