BASH syntax error nc -vvv 192.168.190.130 80 GET /<?php system($_GET['cmd']);?> bash: syntax error near unexpected token `('

Question

This is request I am generating for practicing LFI.

nc -vvv 192.168.190.130 80 GET /<?php system($_GET['cmd']);?>

This is the error I am getting:

bash: syntax error near unexpected token `('

Current using UBUNTU 18.04.

Answer 1

There are a number of issues I can spot.

1. You need to quote your parameters to a command, if they have characters that are interpreted as special characters by bash. Singlequotes are best to escape a string, otherwise you can use backslashes to escape individual characters. Beware of nested quotes of the same type.

   So:

   nc -vvv 192.168.190.130 80 'GET /<?php system($_GET["cmd"]);?>'
   

2. LFI doesn't work like that. The PHP code needs to be in the body of the file you are getting, not in the filename. The filename is not parsed for <?php ... ?> tags.

   So this will just ask the server to give it a file literally called < from the root folder of the website, and the ? will be parsed as the beginning of some parameters.

3. Even if it did somehow detect and run the PHP code as part of the filename, what's $_GET["cmd"] going to be? You didn't pass that in as a GET parameter!

4. If this isn't something you're running, but rather the contents of a PHP script you are calling on a web server... in which case you're trying to do some kind of remote code execution... then you're passing the output of a script that you've specified as a GET parameter (don't do this, it's super insecure), into the path that you're getting from another server through a system call to netcat. In that case why not just do something like:

   <?php file_get_contents('http://192.168.190.138/system($_GET["cmd"])); ?>
   

   or from the commandline:

   php -r 'file_get_contents(\'http://192.168.190.138/system($_GET["cmd"])\');'
   

   ...instead of calling netcat?

---

Overall, I'm afraid this feels like someone trying to mash together two or three things that they found on the internet, without understanding how any one of them works.

But the way to understand them is to do exactly as you are doing: to read the docs, to play with the commands, and every time you have an error, ask questions and dig deeper, to figure out what went wrong.

At the moment, what you have is fractally wrong. Wrong on too many layers to dive into fixing it, only some of which I've touched on. I honestly can't even figure out what it is that you're trying to do.

But that's OK, so long as you learn about each level of wrongness as you run into it. It's how we all learn, sadly :D