webeasy
Mikroo
hackerlab
Task: an Apache/PHP site exposed a hidden upload vhost and stored uploaded files inside a web-accessible uploads directory. Solution: reuse the available PHP shell for RCE as apache, then abuse perl with cap_setuid to read /root/flag.txt as root.
$ ls tags/ techniques/
vhost_enumerationunrestricted_file_uploadwebshell_rcecapability_abuse
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub to get started.
$ssh [email protected]