4 ms·
The problem is that php expects a string that is then passed to sh -c, which is then parsed by a shell. Instead php should have an interface that accepts:
by kpcyrd 7y ago
The problem is that php expects a string that is then passed to sh -c, which is then parsed by a shell.
Instead php should have an interface that accepts:
exec(["sudo", "pihole", "-a", "addstaticdhcp", $mac, $ip, $hostname]);
without any shell trickery.
If there's a sudo in this specific like doesn't matter, your reverse shell is going to run as a regular user and after that it only matters low locked down the sudoers configuration is.
- kilburn 7y agoDefinitely not ideal, but php provides the escapeshellarg [1] function you are supposed to use in these situations. You can even implement a "safe" exec function like so: function safe_exec(array $args, array &$output = null, int &$return_var = 0) : string { return exec( implode(' ', array_map('escapeshellarg', $args) ), $output, $return_var ); } // Example usage $output = []; $return_var = 0; echo safe_exec(['ls', '/tmp'], $output, $return_var); var_export($output); echo "Exit code: $return_var\n"; [1] https://www.php.net/manual/en/function.escapeshellarg.php https://www.php.net/manual/en/function.escapeshellarg.php