(untitled)

Yo lainons, assuming I have found Arbitrary Read File vulnerability on some server and I know which php version it has and which server it uses is there a way to list directories or even turn it into Arbitrary command execution? I can read /ets/passwd/ or /var/html/index.php But /proc is forbidden (permission denied)

see if they have a bug bounty and make some money

>>3540 I don't think there is a way to directly list directories, but you could get creative and find out some. Pull down log files, root's .bash_history, locate database (if their server has locate installed) and stuff like that. Reading a file doesn't usually directly lead to command execution, but you can use it grab the .php files the web server is running and from there look over their source for vulnerabilities and credentials.

>>3545 I've tried .bash* but there is none I also got php.ini file, but nothing interesting. It's PHP 7.1 this version is rather safe

>>3541 No bug bounty, I am doing it for teh lulz (I dont't want to do any harm, just test myself) ;D

>>3548 Dude, I'm gonna tell you right now if you don't know how to do it then it's probably best you don't, lest you leave some j00cy crumbs for attribution or let the admin know they got popped by a skid. The point is, don't ask for handouts when you can't even be fuarrrked to google. 1. No soykaf /proc isn't readable from the www user 2. >>3547 sounds like you're not done enumerating 3. >>3548 I mean, at least lie about it ffs. Reported. 4. PHP 7.1 shouldn't be that limiting when you have LFI

>>3551 Well, It obvious that /proc isn't readable, but I have admit I once accessed it via similiar exploit in nodejs server "sounds like you're not done enumerating" what do you mean by this?

>>3551 There is port 22 opened, but I can't find rsa keys on the machine, ~~/.ssh is empty or default keynames has been changed

>>3540 Have you tried log poisoning? If you have access to ssh logs, you can try to inject php code in them just by doing some soykafty login attempts. After that you can get a shell easily.

>>3551 >3. >>3548 I mean, at least lie about it ffs. Reported. The only rule being broken is you announcing a report in thread. Chill out.

As >>3554 said, I believe this is the best option. And as far as I know, this can be done in any log, not only ssh, what increases your chances.

>>3554 Log poisoning is fuarrrking awesome, I have never heard about it before. Unfortunatelly it seems that access.log is read only (which makes sense to mee), also there is no default ssh logs pwning server via ssh '<?php echo system('ls')' ?>'@ip would be hilarious;D

>>3559 Google commix, it may help you. It search for logs and try to gain acess to them. Also, try to use dynamic GET or POST method instead a fixed command.

I'm going to lock this thread now, as you're not being very smart about discussing potentially illegal activities, which is frowned upon. As others have pointed out, if you're asking this manner of questions, you don't know what you're doing well enough to be doing this.