Gain remote code execution through PHP's mail() function 09-05-2014, 01:04 PM
#1
Hello folks..!
Recently I wrote an article about how you can gain remote code execution through PHP's mail() function. I thought I'd share the summary of the article here, then you can check the actual article if you're interested in more technical details.
First, an important notice. This is only possible if PHP is not running in safe mode.
The summary
The fifth parameter in PHP's mail() function let's you modify sendmail's behaviour for the current deliver. If a user is able to control the content of this parameter it could be used to gain remote code execution by writing the log into a PHP file in a directory accessible through the browser.
Then, by injecting some PHP code into the subject, message, etc with functions like system(), exec(), include(), etc the user can then get remote code execution and access to pop a shell on the server.
If the only writable folder has blocked execution of PHP files, like an upload folder, with some modifications this could still be used to dump content of files on the server like /etc/passwd, etc
If you want to read the full article, you can find it here
http://securitysucks.info/exploit-phps-m...execution/
Recently I wrote an article about how you can gain remote code execution through PHP's mail() function. I thought I'd share the summary of the article here, then you can check the actual article if you're interested in more technical details.
First, an important notice. This is only possible if PHP is not running in safe mode.
The summary
The fifth parameter in PHP's mail() function let's you modify sendmail's behaviour for the current deliver. If a user is able to control the content of this parameter it could be used to gain remote code execution by writing the log into a PHP file in a directory accessible through the browser.
Then, by injecting some PHP code into the subject, message, etc with functions like system(), exec(), include(), etc the user can then get remote code execution and access to pop a shell on the server.
If the only writable folder has blocked execution of PHP files, like an upload folder, with some modifications this could still be used to dump content of files on the server like /etc/passwd, etc
If you want to read the full article, you can find it here
http://securitysucks.info/exploit-phps-m...execution/
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)
