How to Achieve RCE on an Uploaded PHP File?
Short answer
B python3 -c "import requests;print(requests.post(url-'http://172.16.200.10/uploads/shell.php',data={'cmd': 'id'}).text)"
Question
Key Takeaways
This question tests whether you know that the PHP shell reads POST data and that Python's requests library requires a dict, not a set, when sending form data.
For CompTIA PT0-002, the correct way to execute commands through an uploaded PHP web shell is to send a POST request with the cmd parameter; the community votes heavily for option B because it properly uses a data dictionary and reads the response with .text.
Common mistake: Option A is a common trap because it uses the POST method, but data={'cmd=id'} is an invalid set literal, not a dict, so the shell never receives the 'cmd' parameter.
Expert Analysis
Why the Answer Is Correct
The PHP file (shown in the exhibit) likely contains code like system($_POST['cmd']);, meaning it only executes commands supplied via HTTP POST parameters. Option B sends a POST request to the shell with a properly formed dictionary {'cmd': 'id'}, and then prints the response body using .text. This satisfies both the HTTP method and the parameter naming expected by the backdoor, allowing the id command to run and return the output to the tester. Community comment [1] explicitly explains this sequence and why B achieves RCE.
Why the Other Options Are Wrong
Option A is wrong because data={'cmd=id'} is a set containing a single string, not a dictionary; running this in Python raises a TypeError when requests tries to form-encode it. Option C uses params, which sends a GET query string, but the PHP script only processes $_POST data. Option D attempts to use .test() on the response object, which does not exist; the correct attribute is .text. Comment [3] also notes that all options contain a typo in url- but this does not change the correct answer.
Community Comment Notes
The community overwhelmingly supports B (71 votes vs 29 for A). Comment [1] gives a detailed rationale: a POST request with cmd=id is required for RCE and B is the only command that does so correctly. Comment [2] shares an AI-generated explanation that reinforces the importance of the .text attribute. Comment [3] points out the universal typo and clarifies that id must be a string, which is exactly how B writes it. No credible community argument supports A; its higher vote count likely comes from hastily recognizing POST as the needed method without checking the data structure.
Official Reference
- https://www.php.net/manual/en/reserved.variables.post.php
- https://requests.readthedocs.io/en/latest/user/quickstart/
- https://owasp.org/www-community/attacks/Command_Injection
These links open the official vendor documentation in a new tab.
Exam Strategy
When choosing a requests command for RCE, first identify whether the server-side script expects POST or GET. Then inspect the Python syntax: data must be a dict for POST forms, and the response body is resp.text. Eliminate options with invalid methods or attributes to quickly arrive at the correct shell one-liner.
Community Votes
71% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
mat22 👍 4Answer is B. To achieve Remote Code Execution (RCE) using this PHP script, you need to send a POST request to the server with the cmd parameter set to a command you'd like to execute. In this case, the command is id, which retrieves the user identity on a Unix-like system. Option B correctly sends a POST request to the specified URL with the cmd parameter set to 'id' and then prints the response text from the server.
-
Alex818119 👍 2 Answered BBing AI says: To successfully achieve remote code execution (RCE) with the provided PHP file, the penetration tester should use the following command: B. python3 -c "import requests;print(requests.post(url-'http://172.16.200.10/uploads/shell.php',data={'cmd': 'id'}).text)" This command sends a POST request to the PHP script with the cmd parameter set to id, and the .text method ensures the response content is printed correctly.
-
kinny4000 👍 1 Answered B'id' should be a string as it is in option B. These all also contain a typo - "url-'http...." should be "url='http...."
-
Kmelaun 👍 2 Answered AA is correct!
-
Nikamy 👍 2 Answered BBBBBBBBB
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.