Upgrade to Pro — share decks privately, control downloads, hide ads and more …

FTP2RCE

Avatar for Bo0oM Bo0oM
March 01, 2021

 FTP2RCE

Avatar for Bo0oM

Bo0oM

March 01, 2021
Tweet

More Decks by Bo0oM

Other Decks in Programming

Transcript

  1. 1. PHP establishes an FTP connection $contents = fi le_get_contents($f);

    2. FakeFTP gives a port with a payload for passive mode 3. Receiving a payload from socket and save to $contents 4. PHP comes to the FTP again. FakeFTP says ok, let's save your fi le using passive mode
 fi le_put_contents($f, $contents); 5. As a socket for passive mode puts the internal FastCGI port. The payload makes RCE