Skip to main content

Server Shell using PHP Code Injection

Code Injection/Execution


In this vulnerability an attacker maliciously takes advantage of a script which contains system functions/calls, to read or execute files on a remote server. This is synonymous to having a backdoor shell. Needless to say that under certain circumstances privilege escalation is possible.
In this example a script is using the exec() function to execute the ping command. However, the host is dynamic as it is being passed via an HTTP GET request.

PHP Injection/Execution


PHP code injection is a vulnerability that allows an attacker to inject custom code into the server side scripting engine. This vulnerability occurs when an attacker can control all or part of an input string that is fed into an eval() function call. Eval will execute the argument as code.


Comments

Post a Comment

Popular posts from this blog

Bypass Ubuntu Login Screen

Here is the new post on the series of the bypassing of the login screens of the different Operating Systems . In this post, we are going to bypass login screen of the 'Ubuntu 16.04 LTS' . This method is basically works on all Ubuntu . Here is the screen of the Login of the Ubuntu 16.04 LTS which we are going to bypass. STEPS:- Steps 1 :  First restart the system and load the GRUB menu by holding SHIFT  key when the BIOS  loads. After that selects ' Advanced Options ' and you will get this menu. Steps 2 :  Then selects recovery mode on the above menu and you will get the following menu. Steps 3 :  Then selects the root menu and you will dropped into root shell of the system. Steps 4 :  Then run the following commands: mount -rw -o remount / passwd <username> After the successful completion of the command, you have successfully changed the root password of the system. You find the root username of the system by changing to the syst
Post a Comment
Read more

Bypass Kali Linux Login Screen

This is the another post of the Operating System Login Mechanism bypass series. In this post, we are going to bypass the login screen of the Kali Linux that works on all Kali rollings. This is method is slightly different from the method of the Ubuntu. STEPS:- Step 1 :  First, boot the Kali rolling and you will find the GRUB Menu of the KALI. Step 2 :  Then press 'e'  key to load the GRUB. Step 3 :  After that, replace 'ro'  to 'rw'  and 'init=/bin/bash'  at the same line and press 'F10'  key to load with this GRUB file. Step 4 :  After the boot, you will dropped into the root shell of the system. Step 5 :  Now, type 'passwd root'  command and enter the new unix password twice of the root user. Now, Reboot the system and boot normally and you are able to login to the root account of the Kali-rolling with the new password. Post written by - M4TRIX_H4CK3R Author  -  https://en.gravatar.com/kalima
Post a Comment
Read more