public-mirrors/GTFOBins.github.io
1
0
Fork 0
mirror of https://github.com/GTFOBins/GTFOBins.github.io synced 2024-12-25 14:30:07 +01:00
Code Issues Projects Releases Wiki Activity

Add sudo and suid to php

Browse Source
This commit is contained in:
Andrea Cardaci 2018-05-25 14:07:26 +02:00
parent 4ea28f8c48
commit 0047d8bfb7
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
_gtfobins/php.md
View File

@ -19,6 +19,14 @@ functions:
- code: | - code: |
export CMD="ls /" export CMD="ls /"
php -r '$p = array(array("pipe","r"),array("pipe","w"),array("pipe", "w"));$h = @proc_open(getenv("CMD"), $p, $pipes);if($h&&$pipes){while(!feof($pipes[1])) echo(fread($pipes[1],4096));while(!feof($pipes[2])) echo(fread($pipes[2],4096));fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);proc_close($h);}' php -r '$p = array(array("pipe","r"),array("pipe","w"),array("pipe", "w"));$h = @proc_open(getenv("CMD"), $p, $pipes);if($h&&$pipes){while(!feof($pipes[1])) echo(fread($pipes[1],4096));while(!feof($pipes[2])) echo(fread($pipes[2],4096));fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);proc_close($h);}'
sudo-enabled:
- code: |
CMD="id"
sudo php -r "system('$CMD');"
suid-enabled:
- code: |
CMD="id"
./php -r "system('$CMD');"
upload: upload:
- description: Serve files in the local folder running an HTTP server. - description: Serve files in the local folder running an HTTP server.
code: | code: |