> For the complete documentation index, see [llms.txt](https://kunalwalavalkar.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kunalwalavalkar.gitbook.io/write-ups/root-me/web-server/php-command-injection.md).
# PHP - Command injection
> Find a vulnerability in this service and exploit it. The flag is on the index.php file.
Let's input `127.0.0.1` as the input field is suggesting.
We can see that our input is used to execute a `ping` command.
We know the flag is on the `index.php` file. In order to `cat` the flag we need to use the `;` separator.
## User Input
```
127.0.0.1 ; cat index.php
```
Looks like our input was processed properly. Let's check the source code.
The source code reveals an interesting piece of code.
## PHP code
```php
```
* The line `shell_exec("timeout -k 5 5 bash -c 'ping -c 3 ".$_POST["ip"]."'")` executes a shell command based on user input ($\_POST\["ip"]).
* The line `"".file_get_contents(".passwd").""` reads the content of a file named `.passwd` and appends it to the `$flag` variable.
* Let's modify our input to `cat` the `.passwd` file.
### User Input
```
127.0.0.1 ; cat .passwd
```
## Flag
```
S3rv1ceP1n9Sup3rS3cure
```
