4 ms·
Example from the Github search: <?php $result=shell_exec("cat ".$_GET['name'].".txt"); echo $result; ?> How to abuse: $_GE
by DanOWar 12y ago
Example from the Github search:
<?php
$result=shell_exec("cat ".$_GET['name'].".txt");
echo $result;
?>
How to abuse:
$_GET['name'] = "/dev/null; rm -rf /; echo ";
- xikrib 12y agoneed root access, no?
- LeonM 12y agoThats not the point. Of course "rm -rf /" won't work, but what about downloading and installing a backdoor? Or modifying the website scripts itself? Or dumping a database? Or... Removing all the files from a filesystem is something only a script kiddy would do, and it's probably a "best case scenario" for the owner of the server, because the impact of that is relatively small (just re-install the server and restore the backups). But once the attacker starts injecting mallware, stealing customer information (credit card numbers anyone?) or anything else nasty they can think of that they would benefit from, then you are in a whole lot more trouble...
- skriticos2 12y agoTrue, but once you have <foo; $any_command_with_user_privilege> you can start executing any user commands. So you do a </dev/null; mkdir ~/www/nefarious; cp ~/www/AdminSettings.php ~/www/nefarious/settingns.txt;> (without the index file you can just view the file as plain text, which probably contains the database username and password. Then you can go on and download a database dump. The attacker probably does not give a damn about root in this scenario.
- Hearty 12y agoFortunately, I've seen quite a few exec("sudo $GET[ in there as well
- deleted 12y ago[deleted]
- izietto 12y agoWrong. `rm -rf /` fails without the `--no-preserve-root` option.
- moloch 12y ago'rm -rf /*' should do the trick; kind enough to leave them with a '/' directory.