Ladon POC Moudle CVE-2019-11043 (PHP-FPM + Ngnix)

Vulnerability Overview

PHP-FPM Remote Code Execution Vulnerability (CVE-2019-11043)

During the Real World CTF organized by Chaitin Tech, foreign security researcher Andrew Danau discovered while solving a CTF challenge that sending the %0a symbol to the target server URL caused abnormal responses, suggesting a vulnerability.

With some misconfigured Nginx setups, a maliciously crafted packet can cause PHP-FPM to execute arbitrary code.

Example

Place it in the same directory as Ladon.exe to perform batch detection on a C-class subnet or url.txt.

Ladon CVE-2019-11043_Poc.ini 批量URL检测(根目录下放url.txt)
Ladon 192.168.1.37/24 CVE-2019-11043_Poc.ini 批量检测C段主机是否存在该漏洞
Ladon http://192.168.1.37:8080/index.php CVE-2019-11043_Poc.ini 指定URL
Ladon 5.5
By K8gege
Call AnyExe/Command
http://192.168.1.37:8080/index.php
load F:\Python279\python.exe
ISVUL: CVE-2019-11043 http://192.168.1.37:8080/index.php

### Download Ladon: https://github.com/k8gege/Ladon

CVE-2019-11043

Most Popular

Ladon POC Moudle CVE-2019-11043 (PHP-FPM + Ngnix)

Vulnerability Overview

Example