Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/gosecure/php7-opcache-override

Security-related PHP7 OPcache abuse tools and demo
https://github.com/gosecure/php7-opcache-override

opcache php7 poc vulnerability

Last synced: about 1 month ago
JSON representation

Security-related PHP7 OPcache abuse tools and demo

Awesome Lists containing this project

README 

        
# PHP OPcache Override



This project contains the demo website and the tools presented in the following blog posts :



 - HackFest presentation: [slides](https://docs.google.com/presentation/d/18y60Xy0eVeUnBXIH_t3ikfly_uyYbtfI6zAuKCHtlac/edit?usp=sharing)

   and [video](https://www.youtube.com/watch?v=yLpsIWh7rvU)

 - http://gosecure.net/2016/04/27/binary-webshell-through-opcache-in-php-7/

 - http://gosecure.net/2016/05/26/detecting-hidden-backdoors-in-php-opcache/



## 010 Editor Template



These templates parse OPcache files generated by a 32 and 64 bit platform.



 - Download [010 editor](http://www.sweetscape.com/010editor/)

 - `Templates` -> `Open Template...` Select OPCACHE_x86.bt or OPCACHE_x86_64.bt

 - Open your OPcache file

 - Press `F5`



## Python System ID Scraper



This tool lets you extract the `system_id` of a `phpinfo()` page.

Simply pass a filename or a URL.



    $ ./system_id_scraper.py info.html

    PHP version : 7.0.4-7ubuntu2

    Zend Extension ID : API320151012,NTS

    Zend Bin ID : BIN_SIZEOF_CHAR48888

    Assuming x86_64 architecture

    ------------

    System ID : 81d80d78c6ef96b89afaadc7ffc5d7ea



## OPcache Disassembler

This tool lets you disassemble an OPcache file.



You can display it as a syntax tree (-t) or pseudocode (-c) on both 32 and 64 bit platforms.

Simply pass a display option, the architecture to use and an OPcache file.



    $ ./opcache_disassembler.py -c -a64 malware.php.bin



    #0 $280 = FETCH_IS('_GET', None);

    #1 ~0 = ISSET_ISEMPTY_DIM_OBJ($280, 'test');

    #2 JMPZ(~408, ->5);

    #3 ECHO('success', None);

    ...



## OPcache Malware Hunter

This tool helps detect malware hidden in OPcache files by looking for manipulated OPcache files. It compiles its own version of the source code, compares the compiled file

with the current cache file and checks for differences. **You must run this tool on the same system as the one where the cache files

have been compiled originally.**



OPcache malware hunter requires four parameters :

  - The location of the cache folder

  - The architecture of the system (32 or 64 bit) 

  - The system_id

  - The php.ini file used



  In the situation where a potentially infected cache file is found, OPcache Malware Hunter will generate an HTML report

  in the filesystem showing the differences between the source code and the infected cache file.

 



 ```

 $ ./opcache_malware_hunt.py /tmp/cache -a64 2d3b19863f4c71f9a3adda4c957752e2 /etc/php/7.0/cli/php.ini

 Parsing /tmp/cache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/payload.php.bin

 Parsing hunt_opcache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/payload.php.bin

 Parsing /tmp/cache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/wp-config.php.bin

 Parsing hunt_opcache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/wp-config.php.bin

 Parsing /tmp/cache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/wp-load.php.bin

 ...

 Parsing /tmp/cache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/index.php.bin

 Parsing hunt_opcache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/index.php.bin

 Parsing /tmp/cache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/wp-includes/pomo/translations.php.bin

 Parsing hunt_opcache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/wp-includes/pomo/translations.php.bin

 Potentially infected files :

  - /tmp/cache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/index.php.bin

 ```



Main page of generated report : 






A typical report page : 



![diff](https://raw.githubusercontent.com/GoSecure/php7-opcache-override/master/static/diff.png)



## Demo

To setup the demo, run the following two commands :



    sudo ./setup.sh

    php -S 127.0.0.1:8080 -c php.ini



Note that on some Linux based systems, the opcache subsystem is compiled out of

the PHP core and must be dynamically loaded. This can be performed by adding

the following statement under the `[PHP]` directive:



    zend_extension=opcache.so



## Dockerized setup



Due to construct 2.9's API breakage, I created a docker container to run this project using construct 2.8. To use:



    docker build -t opcache_analysis .

    docker run -it --rm opcache_analysis sh



Then inside the busybox shell of the container you can use the tools, for example:



    python ./analysis_tools/opcache_disassembler.py -c -a64 index.php.bin