/php-code-injection

name: php-code-injection
description: >
  Exploit PHP code evaluation injection via eval(), assert(), preg_replace /e,
  create_function(), call_user_func(), usort() callbacks, and runtime function
  creation (runkit, uopz). Distinct from OS command injection (shell operators)
  and SSTI (template engines) — this targets direct PHP code evaluation of user
  input.
keywords:
  - php eval injection
  - eval() exploit
  - assert() injection
  - php code injection
  - create_function exploit
  - preg_replace /e modifier
  - call_user_func injection
  - usort callback injection
  - runkit_function_add
  - uopz_set_return
  - php sandbox escape
  - php RCE
  - php expression injection
tools:
  - burpsuite
  - curl
opsec: medium

PHP Code Injection

You are helping a penetration tester exploit PHP code injection where user input is passed to a PHP code evaluation function. The goal is to execute arbitrary PHP code and escalate to OS command execution. All testing is under explicit written authorization.

**This is NOT OS command injection.** Shell operators (`;`, `|`, `&&`) do not work because the injection context is a PHP interpreter, not a shell. You must write valid PHP expressions or statements.

**This is NOT SSTI.** If `{{7*7}}` or `${7*7}` returns `49`, route to the appropriate SSTI skill. If bare PHP code like `phpinfo()` or `1+1` evaluates, you're in the right place.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[php-code-injection] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames.

Scope Boundary

This skill covers PHP code injection — from confirming the injection through achieving OS command execution. When you reach the boundary of this scope — **STOP**.

Do not load or execute another skill. Do not continue past your scope boundary. Instead, return to the orchestrator with:

• What was found (vulns, credentials, access gained)
• Context to pass (injection point, target, working payloads, etc.)

The orchestrator decides what runs next. Your job is to execute this skill thoroughly and return clean findings.

**Stay in methodology.** Only use techniques documented in this skill. If you encounter a scenario not covered here, note it and return — do not improvise attacks, write custom exploit code, or apply techniques from other domains. The orchestrator will provide specific guidance or route to a different skill.

**Bail out on unmet preconditions.** If the Prerequisites for this skill are not met (e.g., user input never reaches a code evaluation function), report a negative finding and return immediately. Do not pivot to unrelated attack vectors.

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• A parameter that gets passed to a PHP code evaluation function
• Common vulnerable patterns: dynamic callbacks, rule engines, plugin systems,

sort comparators, regex with /e modifier, configuration evaluators

• Knowledge of the injection context (eval string, callback name, function body)

Step 1: Assess

If not already provided, determine:

1. **Evaluation function** — which PHP function evaluates user input? 2. **Injection context** — is input the entire expression, a callback name, a function body, or embedded in a string? 3. **Visible or blind** — is output reflected, or side-channel only? 4. **Sanitization** — are dangerous functions disabled (`disable_functions`)?

Vulnerable Functions Reference

| Function | Input Type | Context | |----------|-----------|---------| | `eval($code)` | PHP statements | Full code execution | | `assert($expr)` (PHP < 8.0) | PHP expression string | Single expression | | `preg_replace('/.*/e', $code, ...)` | PHP expression | Deprecated, removed in 7.0 | | `create_function('$args', $body)` | PHP statements | Function body (deprecated 7.2, removed 8.0) | | `call_user_func($callback, ...)` | Callable name | Controls which function is called | | `usort($arr, $callback)` | Callable name | Comparison callback | | `array_map($callback, $arr)` | Callable name | Applied to each element | | `array_filter($arr, $callback)` | Callable name | Filter predicate | | `runkit_function_add($name, $args, $body)` | PHP statements | Creates new function at runtime | | `uopz_set_return($func, $value)` | Mixed | Overrides function return values |

Skip assessment if context was already provided.

Step 2: Confirm Injection

Quick Confirmation Probes

// Arithmetic (most universal)
1+1
7*7

// PHP functions
phpversion()
php_uname()
str_repeat('A',3)

// Time-based (blind)
sleep(5)
usleep(5000000)

**Expected responses for confirmation:**

• `1+1` → `2` (not literal)
• `phpversion()` → version string like `8.1.2`
• `sleep(5)` → 5-second delay

Disambiguate from SSTI

If `phpinfo()` works but `{{7*7}}` also returns `49`, you may be in a Twig/ Blade template context — route to the SSTI skill instead.

Error-Based Confirmation

Inject invalid PHP to trigger errors:

<?php
)
function

PHP errors (`Parse error`, `Fatal error`, `Warning`) in the response confirm PHP code evaluation. The error may reveal file paths and the evaluation function.

Step 3: Exploitation by Context

Context A: eval() / assert() — Full Express