Skip to content

Instantly share code, notes, and snippets.

@jakubboucek
Last active October 21, 2020 01:31
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save jakubboucek/eaca1f24f7e21414aeac4b2f628decf4 to your computer and use it in GitHub Desktop.
Save jakubboucek/eaca1f24f7e21414aeac4b2f628decf4 to your computer and use it in GitHub Desktop.
CVE-2020-15227 trolling
<?php
/**
* Troll your script-kiddie exploiters of CVE-2020-15227 vulnerability
* Make response which gives false hope
*/
private static function trollExploiters(): void
{
if (strpos($_SERVER['REQUEST_URI'] ?? '', '/nette.micro') === 0) {
header('Content-Type: text/plain');
header('X-Powered-By: Nette 0.9-beta');
header('X-Hi-kiddie: Trolling kiddies');
$shell = $_GET['callback'] ?? null;
$cmd = explode(" ", $_GET['cmd'] ?? 'Nette%20Micro')[0];
$p = "/var/www/html/vendor/nette/nette/Application/MicroPresenter.php:136";
if (($shell === 'shell_exec' || !$shell)) {
echo "bash: $cmd: command not found";
} else {
echo "PHP Fatal Error: Call to undefined function $shell() in $p";
}
die(0);
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment