关联漏洞
标题：
PHPUnit 安全漏洞
(CVE-2017-9841)
描述：TYPO3是瑞士TYPO3协会维护的一套免费开源的内容管理系统。PHPUnit是其中的一个基于PHP的测试框架。 PHPUnit 4.8.28之前的版本和5.6.3之前的5.x版本中的Util/PHP/eval-stdin.php文件存在安全漏洞。远程攻击者可通过发送以‘<?php’字符串开头的HTTP POST数据利用该漏洞执行任意PHP代码。
描述
Automated Exploit for CVE-2017-9841 (eval-stdin.php vulnerable file)
介绍
Util PHP eval-stdin.php (CVE-2017-9841) vulnerability is RCE vulnerability in outdated eval-stdin.php.
This exploit is just automation for mentioned vulnerability and is still in development.
Scripted in Ruby 3.0.4 (within 2 hours), tested on Kali linux, Arch Linux, Ubuntu minimal and Termux.
How to run it?
`ruby evil-eval.rb`
Inside of it, when you type `help` you can see what commands are available such as `revshell`, `checkconnection`, `privesc` which are very, very useful.
When you exit it, you shouldn't do CTRL+C (^C), you can do it by just typing `exit`
DISCLAIMER:
For any misuse or illegal action with this exploit I am totally not responsible.
`Keep calm an 'door the planet`
文件快照
[4.0K] /data/pocs/b1765681eb2121df5896d133a0fc5b13e8460f39
├── [3.1K] evil-eval.rb
└── [ 699] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。