once you've fs access, it's rarely extremely hard, unless the systems are very well protected from within (such as with RBAC and what-not). They never protect

once you've fs access, it's rarely extremely hard, unless the systems are very well protected from within (such as with RBAC and what-not). They never protect the systems from within that well because generally it's more effort than it's worth (well, of course, the day a company becomes bankrupt because of an RCE, they'd wish they spent the time - as usual with security). Of course, it doesn't mean it's always possible. It's just likely. Random scenario, since /etc/passwd is available, it tells me the php config sucks. you could just write a php shell and run it on the web interface. Or have the code within requests and read the log file (again, its all about config. if php let you read the file and doesn't only execute for .php files, bang. or if you can write a .php, bang again.) The point really is that I rarely see people caring about protecting anything or following best practices once someone found a bug that affects the system (such as fs access).