Exploiting a backdoor in PHP 8.1.0-dev | Knife @ HackTheBox

PHP version 8.1.0-dev was released with a backdoor on March 28th 2021, but the backdoor was quickly discovered and removed because if this version of PHP runs on a server, an attacker can execute any arbitrary code he wants.

Knife, on the other hand, is an Easy difficulty Linux machine from @HackTheBox which is vulnerable to this particular security breach. The machine runs a traditional Apache web server which uses PHP 8.1.0-dev for the back-end, while the front-end only exposes a static site.

How can we hack inside this server? Let's figure it out in this video!

=== Timestamp ===
00:00 Intro
00:53 PHP's backdoor analysis
01:52 Backdoor exploitation
02:57 knife command overview
03:27 Privilege escalation n.1: knife exec
03:48 Privilege escalation n.2: knife client edit
4:55 Possible consequences of the PHP's backdoor
05:26 How it was possible?
05:50 Conclusions

If you enjoyed the video leave a like and subscribe to my channel!

---
Would you like to support my work? Offer me a virtual coffee :)

Check out my socials:

[marco]

Ti droghi? Perché ora parli in inglese?