Analyze phpinfo output to identify RCE vectors and file upload paths.
npx skills add https://github.com/uphiago/recon-skills --skill phpinfo-to-rce
Please help me install this Agent Skill. Skill: phpinfo-to-rce Source: https://github.com/uphiago/recon-skills/tree/main/recon/phpinfo-to-rce Command: npx skills add https://github.com/uphiago/recon-skills --skill phpinfo-to-rce
This Skill eliminates the need for blind exploit testing when an exposed phpinfo page is discovered during reconnaissance, quickly determining if the target is vulnerable to remote code execution via available exec functions or bypass techniques.
Use the phpinfo-to-rce skill to analyze the exposed phpinfo page at https://your-target.com/info.php, confirm if exec functions are available or viable bypasses exist, and locate a file upload vector to deliver a webshell for code execution.
High-intent search queries and answers about installing and using this skill.
An exposed phpinfo page can be chained to remote code execution by parsing critical directives like disable_functions and allow_url_fopen to identify available exec functions or bypass techniques, then locating file upload paths to deliver a webshell.
When disable_functions restricts standard exec functions, you can attempt bypass vectors like LD_PRELOAD via putenv or FFI in PHP 7.4+ environments to regain code execution capabilities on the target server.
You can discover file upload vectors by scanning for WordPress XMLRPC wp.uploadFile, open registration forms, contact forms, and plugin-specific upload endpoints to deliver a webshell payload for code execution.
Yes, parsing phpinfo output reveals the PHP version, enabled exec functions, and critical security directives like disable_functions and allow_url_fopen, allowing you to quickly assess the viability of remote code execution.
While the primary focus is on WordPress environments and common vectors like XMLRPC wp.uploadFile, the core mechanism of parsing phpinfo for exec functions and bypass techniques applies to any web server exposing a phpinfo endpoint.
You should parse phpinfo for disable_functions to check for bypass needs, allow_url_fopen to understand remote inclusion capabilities, and the PHP version to determine if FFI bypass vectors are available.
wgpsecEnumerate hidden files, endpoints, and source leaks in CTF web applications.
AeonDaveProvide a stealthy PHP webshell with post-exploitation modules for file operations and network scanning.
riparinoDetect webshell uploads using YARA, Sigma, and KQL queries.
cmndcntrlcyberProvide security payloads and bypass techniques for web application penetration testing.
