PHPMailer RCE • Hacker News Board

Re: PHPMailer RCE

#11

Post by dorianm » Tue, Dec 27, 2016, 1:08 AM UTC

Seems to come from the From email field: https://github.com/PHPMailer/PHPMailer/compare/v5.2.17...v5....

More details here: https://www.saotn.org/exploit-phps-mail-get-remote-code-exec...

PHP mail doc: http://php.net/manual/en/function.mail.php

A function that allows to pass arbitrary flags to a command line, what could go wrong... :)

    mail('nobody@example.com', 'the subject', 'the message', null, '-fwebmaster@example.com');

Re: PHPMailer RCE

#12

Post by cebe » Tue, Dec 27, 2016, 2:24 AM UTC

In case anyone needs this:

A script for finding vulnerable versions of PHPMailer on a server:

https://gist.github.com/cebe/d0f5631b432c520a2e6f6be8beddf11...

Finds also really old versions like 2.0.4.

Re: PHPMailer RCE

#13

Post by etcet » Tue, Dec 27, 2016, 2:35 AM UTC

cebe wrote: post #12

In case anyone needs this: A script for finding vulnerable versions of PHPMailer on a server: https://gist.github.com/cebe/d0f5631b432c520a2e6f6be8beddf11... Finds also really old versions like 2.0.4.

Find is a powerful tool:

    find /var/www -name 'class.phpmailer.php' -print -exec grep -ni '%s["'\''], $this->Sender' {} \;

Re: PHPMailer RCE

#14

Post by [deleted] » Tue, Dec 27, 2016, 3:21 AM UTC

etcet wrote: post #13

cebe wrote: post #12

In case anyone needs this: A script for finding vulnerable versions of PHPMailer on a server: https://gist.github.com/cebe/d0f5631b432c520a2e6f6be8beddf11... Finds also really old versions like 2.0.4.

Find is a powerful tool: find /var/www -name 'class.phpmailer.php' -print -exec grep -ni '%s["'\''], $this->Sender' {} \;

[deleted]