[hooneyman]

Some nudges for user?

im trying to edit some .pdf files inside zipfiles, but doesnt work nothing.. =(

[hooneyman]

Yes, got user and shell.. now trying to ROOT. -.- " i think reversing is the path.

[LoadError]

Yes, got user and shell.. now trying to ROOT.  -.- " i think reversing is the path.

Can read user.txt but how did you get foothold?

[hackxor]

There is a file upload feature that allow to read files !

man how did you found that?? i'm playing with the upload function but i'm completely lost

[ph0bos]

How you guys are getting the RCE? I have already found webroot and some stuff, but can't concrete to RCE. I have 403 on most of files requested like user.txt. The symlink thing seems to work, but i can't find any way to RCE. Can you tell me what i should check?

[damnberoo]

Try a zip symlink in the zipped file

thanks got it, btw mate, how did you figure that out

edit: nvm, there is a section in hacktriks on zip and symlinks

[SingaporeFriend]

Normal upload protection bypasses work, if you managed to create a file with those characters inside the zip.

[0xb137c88eb5]

What is the name of ssh key? Can't get any of known like id_rsa, id_ecdsa etc...
UPD: nvm, got it

[hackxor]

Normal upload protection bypasses work, if you managed to create a file with those characters inside the zip.

i've tried using double extension, null byte at the end, and some other techniques but nothing worked as well, i can upload the file but always gonna be a PDF, and using the zip symlink i got the "/shop/index.php" but i didn't know if its possible to bypass the 

$page = isset($_GET['page']) && file_exists($_GET['page'] . '.php') ? $_GET['page'] : 'home';

so how did you triggered the file?

[SingaporeFriend]

1. Create a php reverse shell with the name rev.phpX.pdf
2. Zip it
3. Hex edit the zip archive and change the X (x58) to x00
4. Upload the zip
5. If the upload message now contains a space it was successful