PHP Webshell

Windows machine using TLS certificate enumeration to find a staging subdomain, SSRF to leak admin credentials, a PHP webshell upload for a foothold, and an AlwaysInstallElevated MSI for SYSTEM.

Windows machine exploiting an unprotected change-password endpoint via CSRF to hijack an account, planting a PHP webshell through an SMB-writable IIS site, and recovering Administrator credentials from a WSL bash history file.

Linux machine chaining an LFI-executed webshell (staged via phpLiteAdmin), a port-knocked SSH key hidden with steganography, and a chkrootkit cron exploit for root.

Linux machine bypassing a torrent hosting site’s file upload filter via a Content-Type header change to get a PHP webshell, then exploiting a PAM file-tampering vulnerability for root.

FreeBSD machine chaining an LFI-driven log poisoning webshell with a multiply-encoded backup password, then SSH port forwarding into a root-owned VNC session for root.

Linux machine logging into Nibbleblog with default credentials, exploiting CVE-2015-6967 for a PHP webshell, and abusing an editable sudo-permitted script for root.

Linux machine exploiting a WonderCMS stored XSS (CVE-2023-41425) to plant a PHP webshell, cracking an escaped bcrypt hash, and finding command injection in a custom monitoring tool for root.