Fastcgi Pentesting

FastCGI Pentesting Skill

A skill for enumerating and exploiting FastCGI services, particularly PHP-FPM instances running on port 9000.

When to Use This Skill

Use this skill when:

• You discover port 9000 open on a target
• You need to test FastCGI/PHP-FPM services for vulnerabilities
• You have an SSRF primitive and want to reach internal FastCGI listeners
• You suspect Nginx FastCGI misconfigurations (cgi.fix_pathinfo issues)
• You need to craft FastCGI payloads for RCE
• You're investigating PHP-FPM related vulnerabilities

Quick Reference

Enumeration

1. Initial Reconnaissance

FastCGI typically runs on port 9000 and often only listens on localhost. Start with:

nmap -sV -p9000 <target>

Note: nmap often shows "unknown" service for FastCGI. Manual testing is required.

2. Probe FPM Status Page

PHP-FPM often exposes a status page at /status. Use the bundled script:

./scripts/probe-fpm-status.sh <host>

Or manually:

SCRIPT_FILENAME=/status SCRIPT_NAME=/status REQUEST_METHOD=GET \
  cgi-fcgi -bind -connect <host>:9000

3. SSRF to FastCGI

If you have an SSRF vulnerability in an HTTP service, you can reach internal FastCGI listeners:

./scripts/build-gopher-payload.py <host> <port> <script-path>

This generates a gopher:// payload you can use in your SSRF.

4. Check for Nginx Misconfigurations

Look for cgi.fix_pathinfo=1 combined with improper fastcgi_split_path_info rules. If present, you can often append /.php to static files to execute PHP code.

Exploitation

RCE via FastCGI Request

The most reliable RCE method is sending a crafted FastCGI request with PHP payload injection:

./scripts/fastcgi-rce.sh <host> <existing-php-file-path>

How it works:

• Sets auto_prepend_file via PHP_VALUE environment variable
• Prepends a base64-encoded PHP payload to every request
• Executes arbitrary commands via system()

Example:

./scripts/fastcgi-rce.sh 192.168.1.100 /var/www/html/index.php

SSRF/Gopher Payload for Internal FastCGI

When port 9000 isn't directly reachable but you have SSRF:

./scripts/build-gopher-payload.py 127.0.0.1 9000 /var/www/html/index.php

The script outputs a URL-safe payload. Use it like:

gopher://<host>:9000/_<base64-payload>

Known Vulnerabilities

libfcgi <= 2.4.4 Integer Overflow (2024)

• Crafted nameLen/valueLen in FastCGI records can overflow on 32-bit builds
• Common in embedded/IoT devices
• Yields heap RCE when FastCGI socket is reachable

PHP-FPM Log Manipulation (CVE-2024-9026)

• When catch_workers_output = yes, attackers can truncate/inject up to 4 bytes per log line
• Useful for erasing indicators or poisoning logs

Classic Nginx + cgi.fix_pathinfo

• If fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; lacks file existence checks
• Any path ending in .php gets executed
• Enables path traversal or source overwrite attacks

Scripts Reference

probe-fpm-status.sh

Probes the PHP-FPM status page to confirm service and gather info.

fastcgi-rce.sh

Sends a FastCGI request with PHP payload injection for RCE.

build-gopher-payload.py

Builds a gopher:// payload for SSRF-based FastCGI exploitation.

Workflow

1. Scan - Identify port 9000 with nmap
2. Probe - Test FPM status page with probe-fpm-status.sh
3. Exploit - Use fastcgi-rce.sh for direct access or build-gopher-payload.py for SSRF
4. Verify - Check output for command execution confirmation

References

• FastCGI library integer overflow leading to RCE
• CVE-2024-9026 PHP-FPM log manipulation analysis
• phith0n's FastCGI RCE script