Re: PHP Exploitation

Hi Danux,

It's a bit cheeky to know you never tried c99 php
backdoor, c99.php.

If you're not aware of it, look into this paper
http://www.milw0rm.com/papers/111

Cheers :)
Kish

--- Danux <danuxx@xxxxxxxxx> wrote:

Hi experts, i need your ideas,

By now, i am able to upload php files to a Windows
2003 Server, so i
can execute php code like phpinfo, but i cant
execute passthru command
because of lack of IUSR_MACHINE privileges.
I have run some local php bof's without success.

Do you have another idea to break into the server
through php code uploaded?

Cheers!!!!!

--
Danux, CISSP
Chief Information Security Officer
Macula Security Consulting Group
www.macula-group.com



--
Kishore, Penetration Tester,
17/1,Upstairs,Sarojini St,
Smart Security, T.Nagar,
Chennai - 600 017

Phone: 91 98841 80767


____________________________________________________________________________________
Get easy, one-click access to your favorites.
Make Yahoo! your homepage.
http://www.yahoo.com/r/hs

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • TSLSA-2005-0059 - multi
    ... Affected versions: Trustix Secure Linux 2.2 ... PHP is an HTML-embedded scripting language. ... use of Rest with FTP servers and Range with HTTP servers to retrieve files ... - New Upstream and Multiple Vendor Security Fixes ...
    (Bugtraq)
  • [NEWS] PHP Security Vulnerability in Multipart FORM Data Handling
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The PHP Group has learned of a serious security vulnerability in PHP ... code with the privileges of the web server. ...
    (Securiteam)
  • TSLSA-2007-0017 - multi
    ... Affected versions: Trustix Secure Linux 2.2 ... PHP is an HTML-embedded scripting language. ... SECURITY Fix: Arnaud Giersch has reported a weakness in ELinks, ... The Common Vulnerabilities and Exposures project ...
    (Bugtraq)
  • Re: Securing an Email script
    ... request to our sales office. ... Since you do ZERO checking on the values it's nothing BUT security issues. ... very powerful PHP function to validate form fields and other strings - ...
    (comp.lang.php)
  • [ GLSA 200511-08 ] PHP: Multiple vulnerabilities
    ... PHP suffers from multiple issues, resulting in security functions ... bypass, local Denial of service, cross-site scripting or PHP variables ...
    (Bugtraq)