Bypass_Disable_functions_Shell

https://github.com/l3m0n/Bypass_Disable_functions_Shell

一个各种方式突破Disable_functions达到命令执行的shell

防御

dl,exec,system,passthru,popen,proc_open,pcntl_exec,shell_exec,mail,imap_open,imap_mail,putenv,ini_set,apache_setenv,symlink,link

功能

imap_open bypass

利用环境变量LD_PRELOAD来绕过

ImageMagick绕过

imagecreatefromgd2

test

PHP OPcache

mail函数

利用pcntl_exec突破

#exec.php
    #/tmp/b4dboy.sh#!/bin/bashls -l /

破壳bash漏洞

dl

PHP 5.x - COM functions safe_mode and disable_function bypass

win_shell_execute

Bypass PHP system functions disabled via mod_cgi

mail的exim扩展bypass