Post cover image

August 28, 2026

From File Upload to RCE: Understanding Chankro and LD_PRELOAD in PHP

While studying Web Security and Penetration Testing, it is easy to think of a File Upload vulnerability as simply a bug that allows an…

By Ali Amed

4 min read

While studying Web Security and Penetration Testing, it is easy to think of a File Upload vulnerability as simply a bug that allows an attacker to upload a .php file.

However, the real impact can be much deeper.

A seemingly simple file upload issue can become part of a complete attack chain:

File Upload → PHP Execution → Restricted Functions → Bypass → RCE

This is where techniques such as LD_PRELOAD and tools like Chankro become interesting.

🔹 What is a File Upload Vulnerability?

A File Upload vulnerability occurs when a web application allows users to upload files without properly validating and restricting them.

For example, an application may be designed to accept:

profile.jpg

But if the validation is weak, an attacker may be able to upload a file containing executable code.

The vulnerability becomes significantly more dangerous when the uploaded file is stored inside the Web Root and the web server is configured to execute it.

The attack chain can look like:

Attacker
   ↓
Upload malicious file
   ↓
Web Server
   ↓
File gets interpreted
   ↓
Code Execution

This can potentially lead to Remote Code Execution (RCE).

🔹 Is Checking the File Extension Enough?

No.

Simply checking whether a filename ends with:

.jpg
.png
.gif

is not sufficient protection.

A secure upload mechanism should consider multiple properties, including:

  • File extension
  • MIME type
  • Magic bytes / file signature
  • Actual file structure
  • File size
  • File content

For example, GIF files commonly start with:

GIF87a

or:

GIF89a

However, simply placing GIF89a at the beginning of a file does not make the file a valid GIF.

Strong validation should verify that the uploaded file is actually a valid image rather than trusting its filename or a single header.

🔹 What Happens When PHP Functions Are Restricted?

Administrators may disable dangerous PHP functions using:

disable_functions

For example:

system()
exec()
shell_exec()
passthru()

The goal is to reduce the ability of PHP applications to execute operating-system commands.

So if an attacker obtains PHP code execution and tries:

system("whoami");

the function may be blocked.

But this introduces an important security concept:

Disabling a few functions does not necessarily eliminate every possible path to process execution.

This is where understanding the application's entire attack surface becomes important.

🔹 What is LD_PRELOAD?

LD_PRELOAD is a Linux dynamic-linker mechanism that allows a shared library to be loaded before other libraries.

Conceptually:

Normal:
Application
     ↓
libc
     ↓
Function

With LD_PRELOAD:

Application
     ↓
Custom Shared Library
     ↓
libc

This mechanism can be used for techniques such as function hooking, where the behavior of functions used by a process can potentially be modified.

From a security perspective, the danger appears when an attacker can influence this mechanism and cause untrusted code to be loaded into another process.

🔹 Where Does putenv() Come In?

PHP provides a function called:

putenv()

which can modify environment variables for the process.

In the technique discussed by Chankro, the attacker attempts to influence an environment variable such as:

LD_PRELOAD

and combine it with a process launched from PHP.

Conceptually:

PHP
 │
 ├── putenv()
 │       ↓
 │   LD_PRELOAD
 │
 └── Process execution
          ↓
     Dynamic Loader
          ↓
     Custom .so

Under the right conditions, this can provide an alternative path to code execution despite some PHP restrictions.

🔹 What is Chankro?

Chankro is a tool designed to automate parts of this technique.

Instead of manually preparing the PHP dropper, shared library, and payload, Chankro generates the required components.

For example:

python3 chankro.py \
    --arch 64 \
    --input c.sh \
    --output hack.php \
    --path /var/www/html/uploads

Here:

c.sh

is the payload/input.

While:

tryhackme.php

is the generated PHP script.

So Chankro is not simply converting a .sh file into a .php file.

The idea is closer to:

Payload
   ↓
Chankro
   ↓
PHP Dropper
   ↓
Technique
   ↓
Payload Execution

🔹 When Would You Use Chankro During a Pentest?

This is probably the most important lesson.

You should not use Chankro simply because you discovered a File Upload vulnerability.

First, understand the environment:

Can I upload a file?
        ↓
Can PHP actually execute?
        ↓
Can I execute OS commands normally?
        ↓
If not, why?
        ↓
Are PHP functions restricted?
        ↓
Is the target Linux?
        ↓
Is the technique compatible with the environment?
        ↓
Does the engagement scope allow RCE testing?

If the environment matches the technique, Chankro may be one possible avenue to investigate.

If PHP execution is not possible in the first place, Chankro is not going to magically create PHP execution.

Likewise, if normal command execution already works, there is usually no reason to introduce a more complicated bypass just to prove the same impact.

🔹 How Can We Defend Against This?

From a defensive perspective, relying only on:

disable_functions

is not enough.

The goal should be to break the attack chain as early as possible.

1️⃣ Prevent PHP Execution in Upload Directories

Uploaded files should not be interpreted as executable PHP code.

2️⃣ Store Uploads Outside the Web Root

Instead of storing user-controlled files directly under:

/var/www/html/uploads/

use a dedicated storage location that is not directly executable by the web server.

3️⃣ Don't Rely Only on File Extensions

Use multiple validation layers:

Extension
   +
MIME Type
   +
Magic Bytes
   +
File Parsing

For images, re-processing the uploaded image and generating a clean copy can provide an additional layer of protection.

4️⃣ Apply Least Privilege

The web server account should not have unnecessary write permissions over:

Application directories
System directories
Executable locations

The fewer privileges the web application has, the harder it becomes for an attacker to escalate the impact of a compromise.

5️⃣ Reduce Process Execution Capabilities

If the application does not need to launch external processes, avoid giving it unnecessary permissions and capabilities to do so.

🔥 Final Thoughts

The most important lesson from studying Chankro is not memorizing a command or payload.

It is learning how to think about an attack chain.

A vulnerability might start as:

File Upload
     ↓
PHP Execution
     ↓
disable_functions
     ↓
Alternative Execution Primitive
     ↓
LD_PRELOAD
     ↓
Code Execution
     ↓
RCE

That's why, during a penetration test, the right question isn't only:

"Is there a File Upload vulnerability?"

The better question is:

"What can an attacker actually do after uploading the file?"

Understanding that difference is what turns basic vulnerability discovery into real-world Web Exploitation.