×
Copy
Open
Link
Embed
Share
Beginning
This slide
Copy link URL
Copy link URL
Copy iframe embed code
Copy iframe embed code
Copy javascript embed code
Copy javascript embed code
Share
Tweet
Share
Tweet
Slide 1
Slide 1 text
2012/11/03 @ PHPCONF
Slide 2
Slide 2 text
• aka Orange • 2009 • 2011 • 2011 AVTOKYO • – – Web Security – Windows Vulnerability Exploitation
Slide 3
Slide 3 text
• CHROOT Security Group • NISRA • case. • Blog – http://blog.orange.tw/
Slide 4
Slide 4 text
No content
Slide 5
Slide 5 text
No content
Slide 6
Slide 6 text
No content
Slide 7
Slide 7 text
■■
Slide 8
Slide 8 text
No content
Slide 9
Slide 9 text
Slide 10
Slide 10 text
• Low – Sensitive Information Leakage… • Middle – Insecure File Download/Access… • High – Local File Inclusion, Code Injection, SQL Inj…
Slide 11
Slide 11 text
No content
Slide 12
Slide 12 text
• – – –
Slide 13
Slide 13 text
• showNews.php?id=198 – showNews.php?id=198/1 • checkName.php?u=lala – checkName.php?u=lala%cc' • getFile.php?path=hsu.doc – getFile.php?path=./hsu.doc • main.php?module=index – main.php?module[]=index
Slide 14
Slide 14 text
No content
Slide 15
Slide 15 text
No content
Slide 16
Slide 16 text
1. Router, Controller URL Mapping 2. 3. 4. DB ORM PHP orz
Slide 17
Slide 17 text
1. – system exec shell_exec popen eval create_function call_user_func preg_replace… 2. – _GET _POST _COOKIE _REQUEST _ENV _FILES _SERVER HTTP_RAW_POST_DATA php://input getenv …
Slide 18
Slide 18 text
• grep -Re – (include|require).+\$ – (eval|create_function|call_user_func|…).+\$ – (system|exec|shell_exec|passthru|…).+\$ – (select|insert|update|where|…).+\$ – (file_get_contents|readfile|fopen|…).+\$ – (unserialize|parse_str|…).+\$ – \$\$, $a\(\) – ……
Slide 19
Slide 19 text
• grep -Re – \$(_GET|_POST|_COOKIE|_REQUEST|_FILES) – \$(_ENV|_SERVER) – getenv – HTTP_RAW_POST_DATA – php://input – …
Slide 20
Slide 20 text
try { …… $trans->commit(); } catch (xxx_adapter_exception $e) { $trans->rollback(); require_once 'xxx_exceptio$n.class.php' throw new xxx_exception( …… ); }
Slide 21
Slide 21 text
No content
Slide 22
Slide 22 text
No content
Slide 23
Slide 23 text
Slide 24
Slide 24 text
• down.php?name= – config.php – config"php – config.ph> – config.< – c>>>>>"< – c<"< Test on PHP 5.4.8 newest stable version (2012/10/17) Original Will be replaced by < * > ? " .
Slide 25
Slide 25 text
No content
Slide 26
Slide 26 text
• file_get_contents – > php_stream_open_wrapper_ex – > zend_resolve_path – > php_resolve_path_for_zend – > php_resolve_path – > tsrm_realpath – > virtual_file_ex – > tsrm_realpath_r
Slide 27
Slide 27 text
No content
Slide 28
Slide 28 text
• file_get_contents • file_put_contents • file • readfile • phar_file_get_contents • include • include_once • require • require_once • fopen • opendir • readdir • mkdir • ……
Slide 29
Slide 29 text
No content
Slide 30
Slide 30 text
• config.php/. • config.php///. • c>>>>>.
Slide 31
Slide 31 text
No content
Slide 32
Slide 32 text
• Web Browser PHP Output (HTML) – Cross-Site Scripting • DB Management PHP Output (SQL) – SQL Injection
Slide 33
Slide 33 text
SELECT * FROM [table] WHERE username = 'PHPCONF'
Slide 34
Slide 34 text
SELECT * FROM [table] WHERE username = 'PHPCONF\''
Slide 35
Slide 35 text
SELECT * FROM [table] WHERE username = 'PHPCONF%cc\''
Slide 36
Slide 36 text
Σ( ° △ °|||)︴ Before After PHPCONF PHPCONF PHPCONF' PHPCONF\' PHPCONF%80' PHPCONF�\' PHPCONF%cc' PHPCONF岤' 0x81-0xFE 0x40-0x7E 0xA1-0xFE
Slide 37
Slide 37 text
• addslashes • mysql_escape_string • magic_quote_gpc • Special Cases – pdo – mysql_real_escape_st ring
Slide 38
Slide 38 text
No content
Slide 39
Slide 39 text
• $url = "http://phpconf.tw/2012/"; • $url = "http://phpconf.tw/$year/"; • $url = "http://phpconf.tw/{$year}/"; • $url = "http://phpconf.tw/{${phpinfo()}}/"; • $url = "http://phpconf.tw/${@phpinfo()}/";
Slide 40
Slide 40 text
config.php $dbuser = "root";
Slide 41
Slide 41 text
config.php $dbuser = "${@phpinfo()}";
Slide 42
Slide 42 text
$res = preg_replace('@(w+)'.$depr.'([^'.$depr.'\/]+)@e', '$var[\'\\1\']="\\2";', implode($depr,$paths)); https://orange.tw/index.php?s=module/action/ param1/${@phpinfo()}
Slide 43
Slide 43 text
Think PHP
Slide 44
Slide 44 text
No content
Slide 45
Slide 45 text
– – – – – –
Slide 46
Slide 46 text
• PHP Security – http://blog.php-security.org/ • Oddities of PHP file access in Windows®. – http://onsec.ru/onsec.whitepaper-02.eng.pdf
Slide 47
Slide 47 text
No content