2022-11-13 22:52:30 +01:00
|
|
|
# PHP Command Injection
|
|
|
|
|
|
|
|
|
|
Injecting commands to execute code on the server side via php.
|
|
|
|
|
|
|
|
|
|
* [Hacktricks](https://book.hackstricks.xyz/pentesting-web/file-upload)
|
2022-11-13 22:38:01 +01:00
|
|
|
|
|
|
|
|
* Blind injection
|
|
|
|
|
* Verbose injection
|
|
|
|
|
|
|
|
|
|
## Blind Injection
|
|
|
|
|
* Check via ping, open a `tcpdump` on ICMP to listen for packets
|
|
|
|
|
* Redirect to logfile and read
|
|
|
|
|
* Use `sleep` or `timeout` to check if ci is possible in general
|
|
|
|
|
|
2022-11-13 22:52:30 +01:00
|
|
|
### Detect Blind Command Injection
|
|
|
|
|
Try to save output to URI resource like `output.php`
|
|
|
|
|
|
2022-11-13 22:38:01 +01:00
|
|
|
## Functions
|
|
|
|
|
* Watch out for
|
|
|
|
|
* `eval()`
|
|
|
|
|
* `exec()`
|
|
|
|
|
* `passthru()`
|
|
|
|
|
* `system()`
|
