54 lines
1.2 KiB
YAML
54 lines
1.2 KiB
YAML
|
id: privesc-php
|
||
|
|
|
||
|
|
info:
|
||
|
|
name: PHP - Privilege Escalation
|
||
|
|
author: daffainfo
|
||
|
|
severity: high
|
||
|
|
description: |
|
||
|
|
PHP is a popular server-side scripting language that is widely used for web development. It is known for its ease of use, flexibility, and broad support for web frameworks and content management systems. PHP is commonly used to create dynamic web pages, process form data, manage sessions, and interact with databases.
|
||
|
|
reference:
|
||
|
|
- https://gtfobins.github.io/gtfobins/php/
|
||
|
|
metadata:
|
||
|
|
verified: true
|
||
|
|
tags: code,linux,php,privesc
|
||
|
|
|
||
|
|
self-contained: true
|
||
|
|
code:
|
||
|
|
- engine:
|
||
|
|
- sh
|
||
|
|
- bash
|
||
|
|
source: |
|
||
|
|
whoami
|
||
|
|
|
||
|
|
- engine:
|
||
|
|
- sh
|
||
|
|
- bash
|
||
|
|
source: |
|
||
|
|
php -r 'system("whoami");'
|
||
|
|
|
||
|
|
- engine:
|
||
|
|
- sh
|
||
|
|
- bash
|
||
|
|
source: |
|
||
|
|
sudo php -r 'system("whoami");'
|
||
|
|
|
||
|
|
- engine:
|
||
|
|
- sh
|
||
|
|
- bash
|
||
|
|
source: |
|
||
|
|
php -r "posix_setuid(0); system("whoami");"
|
||
|
|
|
||
|
|
matchers-condition: and
|
||
|
|
matchers:
|
||
|
|
- type: word
|
||
|
|
part: code_1_response
|
||
|
|
words:
|
||
|
|
- "root"
|
||
|
|
negative: true
|
||
|
|
|
||
|
|
- type: dsl
|
||
|
|
dsl:
|
||
|
|
- 'contains(code_2_response, "root")'
|
||
|
|
- 'contains(code_3_response, "root")'
|
||
|
|
- 'contains(code_4_response, "root")'
|
||
|
|
condition: or
|