PHPUnit RCE## **VulnerabilityScanner for PHPUnit RCE**
A specialized vulnerability scanner developed to identify and interactively exploit the Remote Code Execution (RCE) vulnerability in PHPUnit's `eval-stdin.php`. This vulnerability affects PHPUnit versions before 4.8.28 and 5.x before 5.6.3 and allows remote attackers to execute arbitrary PHP code via HTTP POST data.
### **Description of the Vulnerability:**
The `Util/PHP/eval-stdin.php` file in PHPUnit, in versions prior to 4.8.28 and 5.x before 5.6.3, has a vulnerability allowing remote attackers to execute arbitrary PHP code. An attacker can exploit this by sending HTTP POST data starting with a `<?php` substring. This poses a significant threat to sites with an exposed `/vendor` directory, giving external access to the `/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php` URI.
### **Features:**
- Mass scanning sourced from a list of URLs.
- Interactive shell mode for single target exploitation.
- Efficient scanning with multi-threading.
- Neat and color-coded console outputs using `rich`.
- Export feature for vulnerable URLs.
### **Installation:**
Ensure you have the required Python packages installed:
```bash
pip install -r requirements.txt
```
### **Usage:**
- Conduct a mass scan using a list of URLs, and output vulnerable ones:
```bash
python exploit.py -f path_to_file_with_urls.txt -o output_vulnerable_urls.txt
```
- Interact with a specific URL using the shell:
```bash
python exploit.py -u target_url
```
### **Arguments:**
- `-f, --file`: Provide a list of base URLs for scanning from a file.
- `-u, --url`: Enter the target URL for interactive shell mode.
- `-o, --output`: Designate a file to store detected vulnerable URLs.
- `-t, --threads`: Specify the number of threads. Defaults to `10`.
### **Disclaimer:**
This tool is intended solely for educational and defensive purposes. Always obtain proper permissions before scanning or exploiting any system. The developer is not responsible for misuse or any potential damages.
登录后查看神龙缓存的 POC 文件快照
登录查看