Assault on PHP Applications.pdf

(2969 KB) Pobierz
Assault on PHP Applications
PHP Vulnerability Exploitation
Author:
Date:
Aelphaeis Mangarae
June 13 2009
th
[Table of Contents]
Web Application Vulnerability Type
Paper Introduction
File Inclusion Vulnerabilities
File Upload Vulnerabilities
Disk File Read/Write Vulnerabilities
Command Execution Vulnerabilities
SQL Injection Vulnerabilities
Insecure Cookie Handling
REQUIRED READING
Greetz To
Page Number
Page 3
Page 4
Page 13
Page 33
Page 49
Page 54
Page 104
Page 114
Page 115
Introduction
"Never increase, beyond what is necessary, the number of words required to explain anything"
William of Ockham (1285-1349)
In this paper I will cover a small array of vulnerabilities that occur in PHP applications.
The vulnerabilities and the exploitation of them shown in this paper are the most common vulnerabilities that
you will find exploits for in the public domain.
As some people learn best by example, I use example vulnerable code and show exploitation of
vulnerabilities in PHP applications.
Real world examples of vulnerabilities in PHP software are also shown to educate the reader.
The server used for demonstration is this paper is a WAMP (Windows, Apache, MySQL, PHP) setup in my
small LAN, the specific details of which are listed below.
Keep in mind the examples in this paper are just examples intended to teach you the basics and is not
necessarily a reflection of real world exploitation.
Test Server Software:
Operating System: Windows XP x64
Database: MySQL 5.1
Web Server: Apache 2.2.0
PHP Version: 5.1.2
Page 3
File Inclusion Vulnerabilities
PHP File Inclusion Explained
What Is PHP File Inclusion?
PHP File Inclusion is done by functions that are a part of PHP (such as include(), include_once()) and allows
PHP to open other files for reading. In the case of using include(), the purpose is to reading a file containing
PHP code to be interpreted [and output].
An Example of PHP File Inclusion (TorrentTrader 2.04 index.php):
<?
//
// TorrentTrader v2.x
//
This file was last updated: 20/July/2007
//
//
http://www.torrenttrader.org
//
//
require_once("backend/functions.php");
The function used to include a file containing PHP code (functions.php located in /backend) is
require_once(). The require_once function is similar to require(), except that PHP will only include the file
once during the scripts execution. require() and other PHP functions that can open, read and interpret code
are documented later in this paper.
What Is The Use of File Inclusion In PHP?
The file inclusion showed above in TorrentTrader (PHP Torrent Tracker Software) is used so that the
index.php can have access to an array of functions contained inside functions.php.
When a file inclusion is done in PHP, the code included from the file will inherit the variable scope of the line
on which the inclusion occurs.
Page 4
register_globals Importance to Exploiting File Inclusions
What Is register_globals in PHP?
register_globals was disabled by default since the release of PHP 4.2.0 and has been DEPRECATED as of
PHP 5.3.0 and then was later removed with the release of PHP 6.0.0 for security reasons.
What is register_globals? register_globals is on option in PHP (php.ini) that allowed global variables to be
set with variables declared in a request (such as GET or POST.)
How can register_globals be misused?
Simply, register_globals can be abused by an attacker by allowing an attacker to set any variable they wish
(including request variables from HTML forms) in a request, which is exploitable if the variables are not
initialised.
Example of Misuse of register_globals
<?php
// /usercp/include/getfile.php
if(!isset($FilePath))
{
$FilePath = '/users/' . $_SESSION['Username'] . 'user.cfg';
}
include($FilePath);
Vulnerable code example is shown above (if register_globals = on)
Exploit:
http://localhost/webApplication/usercp/include/getfile.php?$FilePath=[Local File Inclusion]
Page 5

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin