Skip to content
master
Go to file
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 
 
 
 
 
 
 
 
 

README.md

Chankro

Your favourite tool to bypass disable_functions and open_basedir in your pentests.

How it works

PHP in Linux calls a binary (sendmail) when the mail() function is executed. If we have putenv() allowed, we can set the environment variable "LD_PRELOAD", so we can preload an arbitrary shared object. Our shared object will execute our custom payload (a binary or a bash script) without the PHP restrictions, so we can have a reverse shell, for example.

Example:

The syntax is pretty straightforward:

$ python2 chankro.py --arch 64 --input rev.sh --output chan.php --path /var/www/html

Note: path is the absolute path where our .so will be dropped.

Install

Git

$ git clone https://github.com/TarlogicSecurity/Chankro.git
$ cd Chankro
$ python2 chankro.py --help

BlackArch

# pacman -S chankro
$ chankro --help

About

Herramienta para evadir disable_functions y open_basedir

Resources

License

Packages

No packages published
You can’t perform that action at this time.