PHP Wrappers
April 21, 2024
curl "http://94.237.49.182:39505/index.php?language=php://filter/read=convert.base64-encode/resource=../../../../etc/php/7.4/apache2/php.ini" > php-ini.txt
ORRRR we could just visit the site
Just decode it in the terminal and as we can see here the allow_url_include is on which means that we can do some rce.
As we can see here that we have rce in the server
First pov here in curl
Second pov here in the browser
After that we can just display the files in the current directory of web server
Then after that we can just view the flag in the / directory
For the second way to get the rce we will try the input wrapper
For the third way we will try the expect wrapper
Last updated