[SOLVED] Execute command out a webroot directory with a webshell?

HTB Content Academy
1

Hi everybody,
I have a question. In a windows lab, i have a webshell with authority system privileges. I can execute commands but I can’t execute command as a simple “dir” out of the web root directory ?
Is it possible ? I would like to execute a reverse shell who is out the webroot directory, or a executable ?
Thanks.

2

In a Windows lab environment, if you have a webshell with system-level privileges, you should have the necessary permissions to execute commands on the system. However, the ability to execute commands outside of the web root directory or execute arbitrary executables may be restricted by the configuration of the system or the specific web server you are using.

Here are a few possibilities to consider:

  1. Filesystem Restrictions: The web server may be configured with restrictions that limit the execution of commands or access to files outside of the web root directory. This is commonly done for security reasons to prevent unauthorized access to sensitive system files.

  2. User Context: Even with system-level privileges, the webshell may be running within the context of a specific user, such as the user account associated with the web server process. This user’s permissions and restrictions could prevent you from executing commands or accessing files outside of the web root directory.

  3. Firewall or Network Restrictions: If you’re attempting to establish a reverse shell, there may be firewall rules or network restrictions that prevent the communication necessary for the reverse shell to connect back to your machine.

To overcome these limitations, you can try the following:

  1. Try navigating to a different directory: If you can’t execute commands outside of the web root directory, try changing the working directory to a location within the web root where you have write access. From there, you may be able to execute commands or upload files to that directory.

  2. Upload an executable: If you have the ability to upload files through the webshell, you can try uploading an executable (e.g., a reverse shell payload) to a location within the web root directory and then execute it from there.

  3. Exploit other vulnerabilities: If you’re in a lab environment, you may be able to exploit other vulnerabilities in the system or web server to gain additional privileges or bypass restrictions. This requires a deep understanding of the system and potential vulnerabilities.

3

Hi marek33366.

I was using the wrong method.

Finally I could use mysql to create a php uploader in the webroot directory and upload Netcat.

Once, the connection opened, I was able to go everywhere.

I thank you for your help.

1 Like
4

great usually there are more entrances to a house.