Two PHP sites with XDebug remote debugging enabled and connect-back on: a request with XDEBUG_SESSION_START makes XDebug connect to the requester's address, and the DBGp eval command from that debugger runs PHP code on the server.
Pas commencéDockercommit 87d3be9x86_64 · aarch64Secret
Exploit the XDebug connect-back to run code on a PHP server and get a shell.
Le brief de ce lab se trouve dans son dépôt.