https://mrbeetrootpwn.com/tags/php-webshell/Recent content in PHP Webshell on CyberSec WriteupsHugoen-usFri, 06 Mar 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/hackthebox/htb-love/Fri, 06 Mar 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/hackthebox/htb-love/Windows machine using TLS certificate enumeration to find a staging subdomain, SSRF to leak admin credentials, a PHP webshell upload for a foothold, and an AlwaysInstallElevated MSI for SYSTEM.https://mrbeetrootpwn.com/write-ups/hackthebox/htb-secnotes/Fri, 06 Mar 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/hackthebox/htb-secnotes/Windows machine exploiting an unprotected change-password endpoint via CSRF to hijack an account, planting a PHP webshell through an SMB-writable IIS site, and recovering Administrator credentials from a WSL bash history file.https://mrbeetrootpwn.com/write-ups/hackthebox/htb-nineveh/Thu, 12 Feb 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/hackthebox/htb-nineveh/Linux machine chaining an LFI-executed webshell (staged via phpLiteAdmin), a port-knocked SSH key hidden with steganography, and a chkrootkit cron exploit for root.https://mrbeetrootpwn.com/write-ups/hackthebox/htb-popcorn/Thu, 18 Dec 2025 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/hackthebox/htb-popcorn/Linux machine bypassing a torrent hosting site’s file upload filter via a Content-Type header change to get a PHP webshell, then exploiting a PAM file-tampering vulnerability for root.https://mrbeetrootpwn.com/write-ups/hackthebox/htb-poison/Thu, 13 Nov 2025 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/hackthebox/htb-poison/FreeBSD machine chaining an LFI-driven log poisoning webshell with a multiply-encoded backup password, then SSH port forwarding into a root-owned VNC session for root.https://mrbeetrootpwn.com/write-ups/hackthebox/htb-nibbles/Fri, 04 Jul 2025 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/hackthebox/htb-nibbles/Linux machine logging into Nibbleblog with default credentials, exploiting CVE-2015-6967 for a PHP webshell, and abusing an editable sudo-permitted script for root.https://mrbeetrootpwn.com/write-ups/hackthebox/htb-sea/Fri, 27 Jun 2025 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/hackthebox/htb-sea/Linux machine exploiting a WonderCMS stored XSS (CVE-2023-41425) to plant a PHP webshell, cracking an escaped bcrypt hash, and finding command injection in a custom monitoring tool for root.