Coder Social home page Coder Social logo

cve-2021-3129's Introduction

CVE-2021-3129

Laravel debug rce

食用方法

执行docker-compse up -d启动环境

访问8888端口后点击首页面的generate key就可以复现了

关于docker环境想说的几点：

  • 把.env.example复制到.env作用是开启debug环境
  • 关闭了php.ini的phar.readonly
  • 在resources/view/里添加了一个hello模板并引用了一个未定义变量，同时在routes/web.php添加路由(这个我加在源码里了，没写dockerfile里)

复现效果

复现效果

脚本已放出，脚本要和phpggc项目文件夹在同一级目录下。
通用性不强（至少打我自己的环境可以），大家可自行把phpggc的其它rce链也加进去，提高通杀能力。

参考资源

https://www.ambionics.io/blog/laravel-debug-rce
https://xz.aliyun.com/t/9030#toc-3
https://blog.csdn.net/csdn_Pade/article/details/112974809

cve-2021-3129's People

Contributors

sncker avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.