@MechMK1 That sounds like a fun approach :)

@ConorMancone I'm AaaS - Asshole-as-a-Service :D

:)

So... I have a tricky one and need someone with more penetration testing experience

I'm mucking with a PHP site

I have a vulnerable file upload that allows me to save any file anywhere on the system

I also have an RCE already, so I can confirm that the file upload works as expected - I'm dumping a PHP file into the web root

But there are two issues: one, the file I create will automatically get deleted after a few seconds

Two, I can't actually execute the file even when I know it is there

So to be clear, I'm doing this:

How about overwriting an existing file?

I'm trying to not actually break anything, but they have a lot of dead code laying around, so that's not a bad idea

lol!

@ConorMancone Should I ask if you have a PTA? :D

:) I do - it's an internal website. No fun bug bounties for me!

I don't actually have full control over the filename though. I can put it anywhere in the file tree, and it keeps my extension, but changes the actual filename (in a predictable way though).

As a result I can't over write files that already exist

The whole, "Automatically delete file after a couple seconds" is new to me though

Although even when I try to execute the file while it exists it seems not to work

That is really weird. Perhaps you can run a script that continuously tries to execute the file how it's going to be named

@ConorMancone What do you get, a 404 Not Found or something else?

So it looks like the disappearing files are simply because there are multiple servers in a load balancer via round robin. However, it seems like there is some weird caching going on that is also causing trouble

@nobody yes, 404

BTW, since this topic came up yesterday:

bleepingcomputer.com/news/security/…

@ConorMancone SO the files aren't actually being deleted?

@nobody I haven't had a chance to confirm yet, but it seems like they are not after all - it's just hard to "find" them again because the next requests may not go to the server where the file was uploaded. I want to try just uploading the same file to the same place repeatedly and see if I can get the file on all the servers. I haven't figured out how many there are though. For a few, no problem. For 100...

@ConorMancone I guess so

The fuck...

My first thought that it was just a trolling nonsense post, but on further inspection that user has accounts on many SE sites, and some of which have a little bit of rep. Maybe they mistook security for personal finance (where they also have an account)?

OTOH, they're suspended on Personal Finance

close as too broad? migrate to serverfault? ask slashdot?