Bypass shell_exec or system disabled functions by using GCONV (PHP rce to system())

November 4, 2019 ยท View on GitHub

This is based on https://hugeh0ge.github.io/2019/11/04/Getting-Arbitrary-Code-Execution-from-fopen-s-2nd-Argument/

Credits: @hugeh0ge

It uses iconv, in php, in order to execute the same payload.

Uses cases :

  • You control the first parameter of iconv (in_charset), you can set an env var and you can upload arbitrary files (.so library file and the gconv-modules file) and you know their path.
  • You have a php RCE but system, shell_exec, curl_exec and other functions are disabled but you can setenv (and LD_PRELOAD is blacklisted).

In this example, the files gconv-modules and payload.so are stored in /tmp.

  1. Compile the payload library.
gcc payload.c -o payload.so -shared -fPIC

  1. Upload / write the files gconv-modules and payload.so on the server.

  2. Trigger the php code stored on the server

curl https://mysuperserver.com/poc.php