phpinfo-to-rce

1# PHPInfo → RCE Chain Skill
2 
3Evaluate exposed `phpinfo()` pages for configuration disclosure and the
4prerequisites of a separate execution path. Enabled process functions do not
5create RCE without an authorized code or file-execution primitive.
6 
7## When to Use
8 
9- `source-leak-hunt` flags a target with `info.php` or `phpinfo.php` exposed.
10- You need to confirm whether RCE is possible before investing in upload vectors.
11- Building an attack chain that requires code execution.
12- Target has a file upload path (open registration + XMLRPC, contact form, profile image, etc.).
13 
14## Prerequisites
15 
16- `terminal` with curl.
17- Confirmed exposed phpinfo page (HTTP 200, contains "PHP Version").
18- For RCE: a file upload vector on the same host (XMLRPC with credentials, open registration, contact form, etc.).
19 
20## How to Run
21 
22```bash
23# Step 1: Fetch phpinfo and check for exec restrictions
24curl --max-time 30 --connect-timeout 10 -sk "https://TARGET/info.php" | grep -i "disable_functions"
25 
26# Step 2: If ONLY pcntl_* is disabled, all exec functions are available
27# Step 3: Find upload vector and deliver webshell
28```
29 
30## Quick Reference
31 
32| Check | What to Look For | Implication |
33|-------|-----------------|-------------|
34| `disable_functions` | Only `pcntl_alarm,pcntl_fork,...` | All exec available — RCE possible |
35| `disable_functions` | `exec,system,passthru,shell_exec,popen,proc_open` | Exec blocked — need bypass |
36| `allow_url_fopen` | On | Remote file inclusion possible |
37…