jinhao-l/poc-for-cve-2020-28948-cve-2020-28949Proof-of-concept exploit for CVE-2020-28948 and CVE-2020-28949 targeting PHAR deserialization and inclusion vulnerabilities in Archive_Tar, enabling remote file deletion and code execution.
The files here contain PoC for CVE-2020-28948 & CVE-2020-28949 to achieve remote exploit
The server folder contains a simple upload server which uses the vulnerable Archive_Tar library, located in server/Archive. The server accepts a Tar archive from the user, extracts and store it in the server/uploads/ folder.
To start the server with the vulnerable library:
cd server
make build
make start
To start the server with the patched library:
cd server
make build-patched
make start-patched
Access the remote server through http://localhost:8080
$delete_target in
create_phar.phpsecret.md file, delete .htaccess fileindex.htmlexploit.tar
make create_exploit
exploit.tar to remote server.htaccess is deleted.exploit.tar
make create_exploit
exploit.tar to remote servershell.php is uploaded.
whoami on server)