PHP WRAPPER
OFFSEC - Proving Grounds - SCARECROW1.1
·1985 words·10 mins
OFFSEC PG PRACTICE
XXE
PHP WRAPPER
NEWLINE INJECTION
SUID
Used XXE and PHP wrappers to read files/source code, bypassed the upload blacklist with a PHP reverse shell for initial access, then exploited SUID find to escalate privileges to root.
OFFSEC - Proving Grounds - PWNLAB
·2531 words·12 mins
OFFSEC PG PRACTICE
PHP WRAPPER
MYSQL
MAGIC BYTE
PHP REVERSE SHELL
DIRTYCOW
CVE-2016-5195
Exploited PHP wrappers/LFI to access DB credentials, extract web credentials, upload a malicious GIF/PHP reverse shell, gain access, then exploit DirtyCow (CVE-2016-5195) for root.