56 lines
1.5 KiB
YAML
56 lines
1.5 KiB
YAML
id: privesc-php
|
|
|
|
info:
|
|
name: PHP - Privilege Escalation
|
|
author: daffainfo
|
|
severity: high
|
|
description: |
|
|
PHP is a popular server-side scripting language that is widely used for web development. It is known for its ease of use, flexibility, and broad support for web frameworks and content management systems. PHP is commonly used to create dynamic web pages, process form data, manage sessions, and interact with databases.
|
|
reference:
|
|
- https://gtfobins.github.io/gtfobins/php/
|
|
metadata:
|
|
verified: true
|
|
max-request: 4
|
|
tags: code,linux,php,privesc,local
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
whoami
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
php -r 'system("whoami");'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
sudo php -r 'system("whoami");'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
php -r "posix_setuid(0); system("whoami");"
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: code_1_response
|
|
words:
|
|
- "root"
|
|
negative: true
|
|
|
|
- type: dsl
|
|
dsl:
|
|
- 'contains(code_2_response, "root")'
|
|
- 'contains(code_3_response, "root")'
|
|
- 'contains(code_4_response, "root")'
|
|
condition: or
|
|
# digest: 4a0a0047304502204dea2deccea922ff402d0898f4f4a3ca9044ff4b156bcdb80782ccbd05471597022100ecc5ce20f2433825d62d6abd9ac88e44ebe050d8a7832cfdbd54d850ab3357f4:922c64590222798bb761d5b6d8e72950 |