Видео Website Hacking / Взлом сайта - PHP Shell

[pablito]

Веб-Shell - это скрипт, который позволяет получить удаленный доступ к операционной системе веб-сервера через HTTP-соединение. Хакеры «черной шляпы» часто используют веб-оболочки в качестве бэкдоров для отправки команд взломанной системе!

Вот видео о том, как загрузка зараженной фотографии может захватить весь сервер/сайт.

 

[s4ridzawa_]

мне все таки кажется, что этот метод не очень рабочий, а если стоит проверка на расширение при загрузке файла?

 

[Volcan]

мне все таки кажется, что этот метод не очень рабочий, а если стоит проверка на расширение при загрузке файла?

you can change the ext to many other to avoide detection or blocking like phtml , php4,ph5 etc..., and yes it's effictive method

 

[s4ridzawa_]

you can change the ext to many other to avoide detection or blocking like phtml , php4,ph5 etc..., and yes it's effictive method

i agree with you, but what I mean is that if the server-side code, besides checking the specified file extension, extracts the file name and appends an allowed image extension like .jpg or .png to it, in that case, your uploaded PHP shell stops being functional

 

[Volcan]

i agree with you, but what I mean is that if the server-side code, besides checking the specified file extension, extracts the file name and appends an allowed image extension like .jpg or .png to it, in that case, your uploaded PHP shell stops being functional

sure but you can bypass this with htacess file for example :

RewriteEngine On

# Check if the request is for a file with .jpg extension
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_URI} \.jpg$

# Rewrite the request to remove .jpg extension
RewriteRule ^(.+)\.jpg$ $1 [L]

 

[s4ridzawa_]

sure but you can bypass this with htacess file for example :

RewriteEngine On

# Check if the request is for a file with .jpg extension
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_URI} \.jpg$

# Rewrite the request to remove .jpg extension
RewriteRule ^(.+)\.jpg$ $1 [L]

great idea, but how do we upload this .htaccess file if the server-side code appends a .jpg or .png extension to it? i understand that after processing the file, it will no longer be a web server configuration file. or am i mistaken?

 

[Volcan]

great idea, but how do we upload this .htaccess file if the server-side code appends a .jpg or .png extension to it? i understand that after processing the file, it will no longer be a web server configuration file. or am i mistaken?

that depend on the vulnerability you used to hack into the website so let's say you got admin login's using sql injection
in some cases you can directly upload the shell into the database and fatch it on webpage and don't even upload shell from script side

or if you have RCE you can append the file again to .php

but you can't do it from only upload button