#PHP 8.1 BACKDOOR CODE#

“php -d ‘phar.readonly=0’ phpggc/phpggc laravel/rce3 system command –phar phar -o php://output | base64 -w0 | python -c “import sys print(”.join(.zfill(2) + ‘=00’ for i in ()]).upper())” and save the payload into a file and command. Create a serializable object using PHPGGC: Send 2 bytes to align the contents of the log fileĭata = any 2 bytes dummy 3. Clear logs by sending a payload such as:ĭata = “php://filter/write=-16le|convert.quoted-printable-encode|-8|convert.base64-decode/resource=./storage/logs/laravel.log” 2. To sum it all up, you can exploit this vulnerability in 5 steps: 1. In this case, the first payload is correctly decoded, thus the second one will be decoded correctly too. One of the last methods I tried to trigger the RCE is to use base64 decode for UTF-16, which aligns the payload for 2 bytes. The length of the final payload in the log file is different from one target to another because of the absolute path, which could result in bad decoding of the base64 payload. Hopefully, we can invoke php:// again to clear the log file and have only our payload executed and injected twice. Moreover, the log file has more entries that affect our payload. Writing malicious content with the purpose of decoding and executing it won’t work at first, because PHP ignores bad characters when decoding base64, so the error won’t be written in the Laravel log file.

Default Laravel has the log file in storage/logs/laravel.log which includes every PHP error. However, this is not enough to trigger RCE. The action of reading and writing a file doesn’t give us more insights, but PHP allows us to use filters like php://filter/write=convert.base64-decode/resource=path/to/a/specific/file , and phar:///path/to/specific/file to modify and execute PHP serializable code . In Laravel ignition mode, we have a class named MakeViewVariableOptionalSolution which invokes both functions to be triggered by sending a POST request to /_ignition/execute-solution. It does this using a JSON payload which includes a viewFile parameter.

But how could these functions be malicious for this command? These two functions simply read and write the contents of a file. In order to exploit Laravel RCE (CVE-2021-3129), first we seek to understand how file getcontents() and file putcontents() work. How the Laravel RCE (CVE-2021-3129) works This security issue is relatively easy to exploit and does not require user authentication which is one of the reasons why it has a 9.8 CVSSv3 score.

#PHP 8.1 BACKDOOR CODE#

In typical log poisoning, the attacker needs to exploit a local file inclusion first in order to achieve remote code execution, while in the Laravel framework, we need the Ignition module (Ignition is a page for displaying an error) and a specific chain to trigger this vulnerability. This vulnerability and the steps to exploit it follow a similar path to a classic log poisoning attack. Let’s dive into more details and see how you can exploit this critical vulnerability in Laravel with ! What is CVE-2021-3129?ĬVE-2021-3129 is a Remote Code Execution vulnerability in the Laravel framework which takes advantage of unsafe usage of PHP. The most challenging part was to create a flow for this security flaw and integrate it into our auto-exploiter tool, because it requires a PHP serializable code injection. I discovered this vulnerability for the first time in the Horizontal machine from Hack The Box, and the conditions in which it’s triggered pushed me to understand it in more detail.ĬVE-2021-3129 reminds me of a log poisoning vulnerability but with a different flavor.

Php 8.1 backdoor