Use phar implement php deserialization command execution (test environment to reproduce)
Foreword
Speaking generally deserialization vulnerability, the first reaction is to unserialize () function. However, security researcher Sam Thomas shared the topic "It's a PHP unserialization vulnerability Jim , but not as we know it", the use of meta-data serialized form phar pseudo-protocol sends the user to customize the storage of this feature, extended the anti-sequence php of the attack surface .
phar introduction
In simple terms is that php phar archive. It can archive multiple files into a single file, but without being able to unpack and execute php access, and file: // php: // and the like, but also a flow wrapper.
phar structure consists of four parts
stub phar file identifier in the format xxx <php xxx;? __HALT_COMPILER ();?>;
manifest file attribute information such as compression, storage in a sequence;
contents compressed content file;
signature signature, at the end of the file;
There are two key points, one identification document, must __HALT_COMPILER ();?> At the end, but not the contents of the previous limit, which means we can easily fake a picture file or pdf file to bypass some upload limit; Second deserialized, meta-data information stored in a sequence of phar stored, when the file manipulation functions by phar: // dummy protocol data file is parsed phar deserialized, and this had a lot of file manipulation functions .
Above Taken by: PHPGGC understand PHP deserialization vulnerability.
https://kylingit.com/blog/%E7%94%B1phpggc%E7%90%86%E8%A7%A3php%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E/
Reproduction process
Phar file generation
According to the file structure of our own to build a phar file, php built a Phar class.
Fr_genkfp
Evil.class.php
You will get an error when run directly
The reason: the need to php.ini in phar.readonly set off. (I wasted a lot of time on this, the configuration file must be changed after save, then restart the server)
After performing a generating vul.phar, opened in binary editor shown in FIG.
Can be found from FIG, meta-data already exists in file phar serialized form.
Explain: in fact, the sequence of commands to be executed is stored in compressed file phar
Deserialization
Of a corresponding sequence, there is certainly deserialization operation. phpFile system functions in large part by phar://parsing, exists for meta-dataoperating deserialized.
Test environment as follows: test.php
Access test.php, http://127.0.0.1/test.php?url=phar://vul.phar, get map
execution succeed.
defense
- When the file system parameters controlled function, the parameters of strict filtering.
- Strict check the contents of the uploaded file, rather than just checking the file header.
- Execute commands to disable the system in the conditions permit, the risk of the function code.