How to attack common vulnerabilities in PHP programs (Part 1)

Original author: Shaun Clowes Translation: analysist The reason for translating this article is because the current articles on CGI security all use Perl as an example, while there are very few articles specifically introducing the security of ASP, PHP or JSP. This article by Shaun Clowes provides a comprehensive introduction to PHP security issues. The original article can be found at http://www.securereality.com.au/studyinscarlet.txt. Since the original article is relatively long, and a considerable part of it introduces the background of the article or the basic knowledge of PHP, and does not involve PHP security, I did not translate it. If you want to know more about this, please refer to the original article. The article mainly analyzes the security of PHP from the aspects of global variables, remote files, file uploads, library files, Session files, data types and error-prone functions, and puts forward some useful suggestions on how to enhance the security of PHP. . Okay, enough nonsense, let’s get down to business! [Global variables] Variables in PHP do not need to be declared in advance. They will be automatically created the first time they are used. Their types do not need to be specified. They will be automatically determined based on the context. From a programmer's perspective, this is undoubtedly an extremely convenient method. Obviously, this is also a very useful feature of rapid development languages. Once a variable is created, it can be used anywhere in the program. A consequence of this feature is that programmers rarely initialize variables; after all, when they are first created, they are empty. Obviously, the main function of a PHP-based application generally accepts user input (mainly form variables, uploaded files, cookies, etc.), then processes the input data, and then returns the results to the client browser. In order to make it as easy as possible for PHP code to access user input, PHP actually treats this input data as global variables. For example: Obviously this will show a text box and submit button. When the user clicks the submit button, "test.php" will process the user's input. When "test.php" is run, "$hello" will contain the data entered by the user in the text box. From here we should see that the attacker can create any global variables according to his wishes. If the attacker does not call "test.php" through form input, but directly enters http://server/test.php?hello=hi&setup=no in the browser address bar, then not only "$hello" will be created , "$setup" is also created. Translator's Note: These two methods are what we usually call the "POST" and "GET" methods. The following user authentication code exposes the security issues caused by PHP's global variables: The above code first checks whether the user's password is "hello", and if it matches, sets "$auth" to "1", that is, the authentication is passed. Afterwards, if "$suth" is "1", some important information will be displayed. It looks correct on the surface, and quite a few of us do it, but this code makes the mistake of assuming that "$auth" is empty when no value is set, without thinking about the attacker. Any global variable can be created and assigned a value. By using a method like "http://server/test.php?auth=1", we can completely trick this code into believing that we have been authenticated. Therefore, in order to improve the security of PHP programs, we cannot trust any variables that are not clearly defined. This can be a very difficult task if there are many variables in the program. A common way to protect is to check the variables in the array HTTP_GET[] or POST_VARS[], depending on our submission method (GET or POST). When PHP is configured with the "track_vars" option turned on (which is the default), user-submitted variables are available in global variables and the array mentioned above. But it is worth mentioning that PHP has four different array variables for processing user input. The HTTP_GET_VARS array is used to process variables submitted in GET mode, the HTTP_POST_VARS array is used to process variables submitted in POST mode, the HTTP_COOKIE_VARS array is used to process variables submitted as cookie headers, and for the HTTP_POST_FILES array (provided by relatively new PHP), it is completely An optional way for users to submit variables. A user request can easily store variables in these four arrays, so a secure PHP program should check these four arrays. [Remote File] PHP is a feature-rich language that provides a large number of functions to make it easy for programmers to implement a certain function. But from a security perspective, the more functionality you have, the harder it is to keep it secure. Remote files are a good example of this problem:

"); ?> The above script attempts to open the file "$filename" and displays an error message if it fails. Obviously, if we can specify "$filename", we can use this script to browse any file in the system. However, A less obvious feature of this script is that it can read files from any other WEB or FTP site. In fact, most of PHP's file processing functions are transparent to remote files. For example: If you specify ". $filename" is "http://target/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir", then the above code actually exploits the unicode vulnerability on the host target. The dir command is executed. This makes the include(), require(), include_once() and require_once() support for remote files more interesting in the context. The main function of these functions is to include the contents of the specified file and put them accordingly. PHP code interpretation is mainly used for library files. For example: In the above example, "$libdir" is usually a path that has been set before executing the code. If the attacker can make "$libdir" not set, then he It is possible to change this path. But the attacker can't do anything because they can only access the file languages.php in the path they specify (the "Poison null byte" attack in perl has no effect on PHP). With support for remote files, an attacker can do anything. For example, an attacker can place a file languages.php on a server with the following content: Then set "$libdir" to "http:///". , so that we can execute the above attack code on the target host, and the contents of the "/etc" directory will be returned to the client's browser as a result. It should be noted that the attack server (that is, evilhost) should not be able to execute PHP code. Otherwise the attack code will be executed on the attacking server instead of the target server. If you want to know the specific technical details, please refer to: http://www.securereality.com.au/sradv00006.txt [File Upload] PHP automatic support based on RFC 1867 file upload, let's look at the following example: The above code allows the user to select a file from the local machine. When submit is clicked, the file will be uploaded to the server. This is obviously a very useful function, but the way PHP responds makes it so. This feature becomes unsafe. When PHP first receives such a request, even before it starts parsing the called PHP code, it will first accept the file from the remote user and check whether the length of the file exceeds the "$MAX_FILE_SIZE variable" ” defined value, if these tests pass, the file will be stored in a local temporary directory. Therefore, an attacker can send arbitrary files to the host running PHP, and the files will already be stored on the server before the PHP program decides whether to accept the file upload. I will not discuss the possibility of using file uploads to conduct a DOS attack on the server here. Let's consider a PHP program that handles file uploads. As we said above, the file is received and stored on the server (the location is specified in the configuration file, usually /tmp), and the extension is usually random, something like "phpxXuoXG " form. The PHP program needs to upload the file's information in order to process it, and this can be done in two ways, one that was already used in PHP 3, and the other that was introduced after we made a security advisory on the previous method. However, we can say with certainty that the problem still exists, and most PHP programs still use the old way to handle uploaded files. PHP sets four global variables to describe uploaded files, such as the above example: $hello = Filename on local machine (e.g "/tmp/phpxXuoXG") $hello_size = Size in bytes of file (e.g 1024) $hello_name = The original name of the file on the remote system (e.g "c:temphello.txt") $hello_type = Mime type of uploaded file (e.g "text/plain") Then the PHP program starts processing the file specified according to "$hello", the problem The problem is that "$hello" is not necessarily a variable set by PHP, and any remote user can specify it. If we use the following method: http://vulnhost/vuln.php?hello=/etc/passwd&hello_size=10240&hello_type=text/plain&hello_name=hello.txt, it will result in the following PHP global variable (of course the POST method is also possible (even Cookie)): $hello = "/etc/passwd" $hello_size = 10240 $hello_type = "text/plain" $hello_name = "hello.txt" The above form data just meets the variables expected by the PHP program, but at this time The PHP program no longer handles the uploaded file, but instead handles "/etc/passwd" (usually resulting in content exposure). This attack can be used to expose the contents of any sensitive file. As I said before, the new version of PHP uses HTTP_POST_FILES[] to determine the uploaded file, and also provides many functions to solve this problem. For example, there is a function to determine whether a file is actually uploaded. These functions solve this problem very well, but in fact there must be many PHP programs that still use the old method and are vulnerable to this attack. As a variant of the file upload attack method, let's look at the following piece of code: If the attacker can control "$theme", it is obvious that he can use "$theme" to read any file on the remote system.The attacker's ultimate goal is to execute arbitrary instructions on the remote server, but he cannot use the remote file, so he must create a PHP file on the remote server. This may seem impossible at first, but file uploading does this for us. If the attacker first creates a file containing PHP code on the local machine, and then creates a form containing a file field named "theme" , and finally use this form to submit the created file containing PHP code to the above code through file upload. PHP will save the file submitted by the attacker and set the value of "$theme" to the file submitted by the attacker. In this way, the file_exists() function will pass the check and the attacker's code will be executed. After gaining the ability to execute arbitrary instructions, the attacker obviously wants to escalate privileges or expand the results, which requires some tool sets that are not available on the server, and file uploading once again helps us. An attacker can use the file upload function to upload tools, store them on the server, and then use their ability to execute commands, use chmod() to change the permissions of the file, and then execute it. For example, an attacker can bypass the firewall or IDS to upload a local root attack program and then execute it, thus gaining root privileges.

How to attack common vulnerabilities in PHP programs (Part 1)_PHP Tutorial