Which PHP Functions Are Commonly Exploited for Code Execution and Information Disclosure?

Exploitable PHP Functions

Exploiting PHP scripts requires the use of specific functions that allow for arbitrary code execution. Malicious PHP scripts, such as web shells, must contain one or more functions capable of executing code based on user input. Identifying these functions within PHP files can help narrow down potentially compromised scripts for further investigation.

Shell Execute

• system
• exec
• popen
• backtick operator
• pcntl_exec

PHP Execute

• eval
• preg_replace (with /e modifier)
• create_function
• include[_once] / require[_once]

Information Disclosure

• phpinfo
• posix_mkfifo
• posix_getlogin
• posix_ttyname
• getenv
• get_current_user
• proc_get_status
• get_cfg_var
• disk_free_space
• disk_total_space
• diskfreespace
• getcwd
• getlastmo
• getmygid
• getmyinode
• getmypid
• getmyuid

Other

• extract
• parse_str
• putenv
• ini_set
• mail
• header
• proc_nice
• proc_terminate
• proc_close
• pfsockopen
• fsockopen
• apache_child_terminate
• posix_kill
• posix_mkfifo
• posix_setpgid
• posix_setsid
• posix_setuid

Filesystem Functions

• fopen
• tmpfile
• bzopen
• gzopen
• SplFileObject->__construct
• chgrp
• chmod
• chown
• copy
• file_put_contents
• lchgrp
• lchown
• link
• mkdir
• move_uploaded_file
• rename
• rmdir
• symlink
• tempnam
• touch
• unlink
• imagepng (2nd parameter is a path)
• imagewbmp (2nd parameter is a path)
• image2wbmp (2nd parameter is a path)
• imagejpeg (2nd parameter is a path)
• imagexbm (2nd parameter is a path)
• imagegif (2nd parameter is a path)
• imagegd (2nd parameter is a path)
• imagegd2 (2nd parameter is a path)
• iptcembed
• ftp_get
• ftp_nb_get
• file_exists
• file_get_contents
• file
• fileatime
• filectime
• filegroup
• fileinode
• filemtime
• fileowner
• fileperms
• filesize
• filetype
• glob
• is_dir
• is_executable
• is_file
• is_link
• is_readable
• is_uploaded_file
• is_writable
• is_writeable
• linkinfo
• lstat
• parse_ini_file
• pathinfo
• readfile
• readlink
• realpath
• stat
• gzfile
• readgzfile
• getimagesize
• imagecreatefromgif
• imagecreatefromjpeg
• imagecreatefrompng
• imagecreatefromwbmp
• imagecreatefromxbm
• imagecreatefromxpm
• ftp_put
• ftp_nb_put
• exif_read_data
• read_exif_data
• exif_thumbnail
• exif_imagetype
• hash_file
• hash_hmac_file
• hash_update_file
• md5_file
• sha1_file
• highlight_file
• show_source
• php_strip_whitespace
• get_meta_tags

The above is the detailed content of Which PHP Functions Are Commonly Exploited for Code Execution and Information Disclosure?. For more information, please follow other related articles on the PHP Chinese website!