daffainfo
/
PayloadsAllTheThings
mirror of https://github.com/daffainfo/PayloadsAllTheThings.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
PayloadsAllTheThings/Upload Insecure Files/Configuration Busybox httpd...
History
Swissky 404afd1d71 Fix name's capitalization 2019-03-07 00:07:55 +01:00
..
README.md Fix name's capitalization 2019-03-07 00:07:55 +01:00
httpd.conf Fix name's capitalization 2019-03-07 00:07:55 +01:00
shellymcshellface.sh Fix name's capitalization 2019-03-07 00:07:55 +01:00

README.md

If you have upload access to a non /cgi-bin folder - upload a httpd.conf and configure your own interpreter.

Details from Busybox httpd.c

abbf17abcc/networking/httpd.c (L60)

*.php:/path/php # run xxx.php through an interpreter`

If a sub directory contains config file, it is parsed and merged with any existing settings as if it was appended to the original configuration.

Watch out for Windows CRLF line endings messing up your payload (you will just get 404 errors) - you cant see these in Burp :)