Website Vulnerabilities to Fully Hacked Server
Source: YouTube · John Hammond · published Oct 11, 2023 · 19:52
The video demonstrates how to leverage a PHP vulnerability to escalate Local File Inclusion (LFI) to Remote Code Execution (RCE) using the pearcmd.php file 0:00.
Key Takeaways:
• The exploit works in PHP version 7.3 and below where pearcmd.php is installed by default 1:38
• PHP info() reveals server argv variables which can be controlled through HTTP requests 2:53
• The pearcmd.php file in /usr/local/lib/php/ can be accessed via LFI and accepts command arguments 8:32
• Using the 'config create' command of pearcmd.php allows writing arbitrary PHP code to a new file 13:00
• This technique can be used to create a webshell and eventually obtain a reverse shell 18:15
This technique provides a reliable method for escalating LFI to RCE in older PHP environments without requiring additional file upload capabilities.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
recently I saw this tweet a colleague pointed me today to an insane exploit primitive if you control a PHP include function with the fixed PHP extension and no upload and a link to a blog post here now I don't know if you caught that but that means the local file inclusion vulnerability that you might come across in some web application pen testing but leveraging that lfi all the way up to remote code execution or rce because of the serers side processing that PHP does I've never heard of that I think that's kind of cool normally you'd have to do some like log poisoning techniques but it sounds like you could do it without that in this case so here's this article here's the write up here's the blog seemingly old I think 2021 is the date here but look this is in a language that I don't unde…