I'm trying to pentest a PHP script.

This is the last line of the script that I want to exploit:

Header("Location: ".TOP_DIR."/".base64_decode($_GET['ref'])."&imgid=".$_GET['imgid']);

Is it vulnerable to remote code execution? If so, I want to run the system function inside the base64_decode function:


Is it possible?

  • Hackers would often inject eval-base64 and system-base64 backdoors into Wordpress websites. Surely you don't want to do this to yourself. – Jedi Jul 11 '16 at 3:41
  • base64 is probably 10% safer than sending plain text commands... – dandavis Jul 11 '16 at 5:13
  • 1
    I don't understand your question. What do you mean with "run system inside base64 decode function"? Is system($_GET['cmd']) code that is present already, or is that your desired payload? Could you give us a more complete view of the code you are trying to exploit? – Anders Jul 11 '16 at 7:52
  • @Anders i edited the question to clarify it ... can i inject this code ? is it vulnerable to RCE ? can i insert system($_GET['cmd']) ! – I'm V Jul 11 '16 at 15:01
  • What makes you think you would be able to do that? base64_decode does not execute any code, so it seems impossible to me. – Anders Jul 11 '16 at 15:11

You should never say never, but there is no reason to believe you could exploit that line to gain RCE. The base64_decode function does exactly what the name implies - it decodes base64. To get the parameter value executed you would need a function that executes code provided to it, like eval. You don't seem to have that, so you are out of luck.

With that said, it looks like you could do path traversal, since there is no check for / characters. Not sure how you could exploit that in a redirect response, though. On older versions of PHP you could also do header injection by including a newline, thereby starting a new header.

  • the challenge target is to find RCE ... it's only one file so i think it's useless to find path traversal ... i have to find RCE ..i'll keep trying – I'm V Jul 11 '16 at 15:39

The base64_decode() function is not risky by itself but running arbitrary code on your system is.

Having a script that calls system($_GET['cmd']) is almost an invitation for hackers to mess up your server. As soon as anyone skilled finds it, they will have loads of fun at your expense.

If you're worried about security in any way, you will never let your users decide what runs on your server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.