PayloadsAllTheThings/Upload Insecure Files/Configuration Busybox httpd.conf
2019-03-07 00:07:55 +01:00
..
httpd.conf Fix name's capitalization 2019-03-07 00:07:55 +01:00
README.md Fix name's capitalization 2019-03-07 00:07:55 +01:00
shellymcshellface.sh Fix name's capitalization 2019-03-07 00:07:55 +01:00

If you have upload access to a non /cgi-bin folder - upload a httpd.conf and configure your own interpreter.

Details from Busybox httpd.c

abbf17abcc/networking/httpd.c (L60)

*.php:/path/php # run xxx.php through an interpreter`

If a sub directory contains config file, it is parsed and merged with any existing settings as if it was appended to the original configuration.

Watch out for Windows CRLF line endings messing up your payload (you will just get 404 errors) - you cant see these in Burp :)