ianxtianxt/bypass_disablefunc_via_ld_preload解决php提权的时候因系统禁用函数导致无法执行命令的情况
bypass_disablefunc.php has three GET options: cmd, outpath and sopath.
The options are very simple,
cmd is your evil command,
outpath is the output file path of the command (readable and writable),
sopath is the absolute path of our shared object bypass_disablefunc_x64.so. For example:
The first is the cmd parameter, the system command to be executed (such as pwd);
The second is the outpath parameter, the file path for saving the command execution output (such as / tmp / xx), so that it can be displayed on the page. In addition, regarding this parameter, you should note whether the web has read/write permission, whether the web can access it across directories, and that the file will be overwritten and deleted;
The third is the sopath parameter, which specifies the absolute path of the shared object that hijacks system functions (such as /var/www/bypass_disablefunc_x64.so). Also, regarding this parameter, you should note whether the web can access it across directories.
In addition, bypass_disablefunc.php concatenates the command and the output path into a complete command line, so you don't need to redirect in the cmd parameter.
bypass_disablefunc_x64.so is a shared object for executing commands, compiled using the command gcc -shared -fPIC bypass_disablefunc.c -o bypass_disablefunc_x64.so
It is compiled from bypass_disablefunc.c. If the target is an x86 architecture, you need to add the -m32 option and recompile bypass_disablefunc_x86.so.
Find a way to upload bypass_disablefunc.php and bypass_disablefunc_x64.so to the target. After specifying the three GET parameters, bypass_disablefunc.php can bypass disable_functions.
Known issues:
