执行HTML编码的PHP代码

Question

Hello stackoverflow community,

I am trying to send a request from Burp Suite:

{"html":"<?php
$to = "example@example.com";
$subject = "Subject";
$txt = "PHP is installed"; 
$result = mail($to,$subject,$txt);
?>","author":"","location":""}

I need to modify the "html" tag to contain some PHP, but the PHP is not read (neither are any of the other tags) because of the double quotes in the code (I think) so I tried HTML encoding it but then it wouldn't execute, it just showed up as plain text of the code.

I have been trying all day to figure this out and couldn't find anything.

So in conclusion: is there any alternative to quotes I can use? (I tried HEREDOC) or is there a way to execute HTML encoded PHP without quotes?

Answer 1

The double quotes aren't the problem. It's likely that the file extension isn't a type that gets sent to the PHP interpretter.

If you're using Apache, you can solve this with a .htaccess directive.

Suppose the file you just posted has a .json extension. Then the .htaccess directive would look something like.

Options +ExecCGI
AddType application/x-httpd-php .php .json
AddHandler x-httpd-php5 .php .json

However you're not echoing anything. So it's entirely possible that this is NOT the problem, and instead it's simply that your webserver doesn't have email configured, so it can't send the email. (Although in that case it should echo an error in most configurations.)

You can test just to see if it's working by using something like:

<?php echo "This is working now."; ?>

Answer 2

You could make this work, but I wouldn't recommend doing it that way.

If you remove the PHP tags and pass through the code you want to run as a string you're going to end up having to run it through eval(), which is dangerous because it means anyone with access to the first script can potentially execute whatever code they like on your server. Any PHP script with an 'eval()' in it needs to be pretty locked down.

Reference:

http://php.net/manual/en/function.eval.php

You're better off just passing the URL of the script you want it to execute, or something along those lines :)