Re: [white-paper] Pwning PHP mail() function For Fun And RCE (ver 1.0)

[Kash Pande <kash () tripleback net>]

On 03/05/17 04:32 PM, Dawid Golunski wrote:
> Here's a paper I wrote back in December.  It was originally meant to go
> into Phrack but the team wanted a more general article on parameter injection
> as mail() was supposedly an outdated technique.
> Meanwhile, the RCE-chain continues :) So I decided to post it as it is without
> changing it as mail() injection deserves a separate article imho.
>
> https://exploitbox.io/paper/Pwning-PHP-Mail-Function-For-Fun-And-RCE.html

This article purposely uses a litany of poor programming practices to 
expose an alleged exploit in PHP mail().. I'd like to see the same 
exploit, without assuming the developer on the software had no idea what 
they're doing (passing non-sanitized variables to functions). As well, 
you noted in your own article that this 'discovery' was first published 
in 2011 by someone else.

> I reveal some exim code-execution vectors in there that should change
> the whole game slightly :)

Not really, because it still relies on unfiltered input.