Archive for the “php” Category
Before you read any further note, I will not be including the original hack file, simply due to peoples stupidity in putting this on a production environment to play with, if you use the code you do so at your own risk, and by reading this blog entry / using the code provided you agree to accept all liability upon yourself for your own actions. Don’t be an idiot.
Around 10 days ago I came across this seemingly innocuous little file.
What I am going to cover in this entry is dissecting the ‘payload’ and not so much the web app in question or methods used to compromise it,
Whereas I will not at this time provide the original file, I will provide you with the md5 and sha1 hashes of the file so you can check it’s not lurking on your systems:
md5: 9ee3e6523d154114460d320477a8665a
sha1: 9c64fecea5620d70a716bbd74f6e89612a4a79c7
The bit we are interested in is the last line of the file:
Were you to run this line you would get
Confused yet? now I can appreciate the thinking behind packing a payload to avoid detection, but in this case the payload is packed 12 times, and no before you ask I did not manually run each returned statement to find this out.
Enter Python-Fu:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
| #!/usr/bin/env python
# saiweb.co.uk payload unpack script 26/05/2010
# copy the eval(gzinflate()) line to payload.raw, place in same directory as this file.
"""
Copyright (C) 2010 Buzz saiweb.co.uk.co.uk
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
Additional Terms as Per section 7
Attribution:
Redistribution/Reuse of this code is permitted under the GNU v3 license, as an additional term ALL code must carry the original Author(s) credit in comment form.
"""
import base64, zlib, re, sys
def main():
print 'Running ...'
f = open('payload.raw')
php = f.read()
f.close()
iteration = 0
while re.search('eval\(gzinflate\(base64_decode\(\'',php):
iteration += 1
print 'Iteration: %d' % iteration
raw = re.sub('eval\(gzinflate\(base64_decode\(\'','',php)
raw = re.sub('\'\)\)\);','',raw)
gstring = base64.b64decode(raw.strip())
php = zlib.decompressobj().decompress('x\x9c' + gstring)
#print payload
#sys.exit()
print php
if __name__ == '__main__':
main() |
Copy the first payload lines into a file named payload.raw, take the above code and copy it into a file named dissect.py.
When dissect.py is run you will get the following output:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
| python ./dissect.py
Running ...
Iteration: 1
Iteration: 2
Iteration: 3
Iteration: 4
Iteration: 5
Iteration: 6
Iteration: 7
Iteration: 8
Iteration: 9
Iteration: 10
Iteration: 11
Iteration: 12
<?php
... |
As such you may want to run it using the following command:
1
| python ./dissect.py > r57.php |
And what you will find after unpacking 12 times in total, the “payload” is the r57shell, this script is an information gathering tool and pseudo shell, meaning it will run any command on the host server that php can, providing in most cases ssh esq access to the exploited host, allowing you to do pretty much anything you wanted at this point, some of the features also include /etc/passwd /etc/shadow dumping, aswell as searching for a tirade of common file *.sql* admin* etc, it’s a one stop script for information gathering on a LAMP/WAMP based host.
Defense: modify php.ini to disable eval(), exec, shell_exec and all none essential functions.
And of course, ensure your web apps are patched and up to date as well as the host they are running on.
Tags: dissecting, hack, php, python, r57, r57shell
No Comments »
Posted by: Buzz in php
In some situations using a double quotes string is required i.e. “this\nstring\nappears\over\nmany\nlines” …
However in 99% of cases it is used without even thing about in implications of doing so … PHP will infact evaluate any string wrapped in double quotes, this adds a processing overhead, but it seems people do not actually reliase how much in comparrison to using single quotes for the same string.
Take for example this code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
| <?PHP
/**
* double-quotes-are-bad.php ~ D.Busby (Saiweb.co.uk)
**/
$start = microtime(true);
$var = "This is a stiring it may not actually have anything to be parse within"
. " However the issue remains that infact php will attempt to evaluate every char"
. " In this string, which in this example may not be so bad, as it's just one string"
. " In one file, buit imagine what happens when every string in your webapp uses double quotes";
$end = microtime(true);
$len = strlen($var);
$res = round($end-$start,10);
echo $len.' Chars evaluated in '.$res.' seconds'."\n";
$start = microtime(true);
$var = 'This is a stiring it may not actually have anything to be parse within'
. ' However the issue remains that infact php will attempt to evaluate every char'
. ' In this string, which in this example may not be so bad, as it\'s just one string'
. ' In one file, buit imagine what happens when every string in your webapp uses double quotes';
$end = microtime(true);
$len = strlen($var);
$res2 = round($end-$start,10);
echo $len.' Chars evaluated in '.$res2.' seconds'."\n";
$speed = round((1 - $res2/$res) * 100,2);
echo 'Single quotes are '.$speed.'% faster'."\n";
?> |
Now I am running this on a live server, that is serving in excess of 100 pages a second, take a look at the output:
320 Chars evaluated in 1.40667E-5 seconds
320 Chars evaluated in 3.0994E-6 seconds
Single quotes are 77.97% faster
320 Chars evaluated in 1.28746E-5 seconds
320 Chars evaluated in 3.0994E-6 seconds
Single quotes are 75.93% faster
320 Chars evaluated in 1.3113E-5 seconds
320 Chars evaluated in 2.1458E-6 seconds
Single quotes are 83.64% faster
320 Chars evaluated in 1.19209E-5 seconds
320 Chars evaluated in 2.861E-6 seconds
Single quotes are 76% faster
320 Chars evaluated in 1.3113E-5 seconds
320 Chars evaluated in 2.861E-6 seconds
Single quotes are 78.18% faster
320 Chars evaluated in 1.3113E-5 seconds
320 Chars evaluated in 2.861E-6 seconds
Single quotes are 78.18% faster
The improvement is consistently in excess of 75%, so the moral of the story? don’t use “” if you do not need to!
Thanks to everyone along the way who’ve discussed and proven development methods along the way with me, and sorry it’s taken so long to get them written up.
4 Comments »
Posted by: Buzz in php
Call to undefined function imagettfbbox()
Either you do not have php GD installed (check your phpinfo(); and see if GD has laoded with TTF support)
Or if you are compiling from source add: –with-gd –with-freetype-dir=/lib64 –with-ttf=/lib64 –enable-gd-native-ttf
to your configure line.
Note: you’ll need gd-devel and freetype-devel libs installed, and im using /lib64 as im running a 64bit OS.
No Comments »
Posted by: Buzz in flowplayer, php
Finaly it is ready and in a state I am happy to release it.
Features
- Complete code re-write, much more efficient and easier to update
- Flowplayer 3.1.1
- License detection, will only use the commercial version if you enter a license!
- Playlists
- Better wordpress API integration, all settings now stored in wordpress no more config files!
- Same admin interface
(Videos from Apple.com)
Tags: flowplayer, wordpress
2 Comments »
Posted by: Buzz in Linux, php
PHP mail() not working?
getting “sh: -t: command not found” when testing using the cli?
what you have is a missing devel package!!!!
In my case sendmail-devel was missing, you’d think the configure script would alert on this but alas no, devel pack installed and one recompile later and the issue is solved.
3 Comments »
Posted by: Buzz in php
Because a picture is worth over 9000 internets … apparently
UPDATE: AKA “hayabusayuri” link … seriously who plays everquest? … maybe all that time playing everquest finally made the guy snap … and PHP & windows … never a good combination … infact Windows and internet is a bad combination
LINKY
Screencap incase it is removed:
(Thanks to the guys who forwarded me this)
Tags: 48139, bug, php
No Comments »
Posted by: Buzz in flowplayer, php
Tonight I will be pushing to the development SVN a beta preview of the 2.1 release.
Here are some of the changes:
Poor tags, we barely knew them…
GOODBYE! inpost tags, (sort of), configuration will no longer be handled using the inpost tags, the old tag structure will be retired in favor of an anchor to place the player in your content [FLOWPLAYER], configuration of the player will now be handled by an admin menu box.
That’s quite a list you’ve got there…
(basic) Playlists support has been added, this is configurable from the admin menu for the post
Dude, where’s your config file?
The saiweb_wpfp.conf file has now been removed *gasp*, now reliant in internal wordpress *magic* for the storing of the plugin config.
Your media is a great big canvas, and you should throw all the paint you can on it
Fixed a bug with the canvas colour settings
Is that a logo in your pocket, or are you just pleased to see me?
The commercial version of flowplayer will now only be used if a license key is specified, the free version will now be used if no key is specified which has a reduced logo branding.
I Once Was Blind, But Now I See
Player embed causing issues with some navigation menus, this should be resolved with the wmode setting.
Details of how to get the preview version and install it along with screen casts of the new menus (time allowing) will be added to this post once everything is committed to subversion.
UPDATE: 15/04/2009 Got my hands on flowplayer 3.1 code is around 60% finished, went for a complete re-write.
Tags: 2.1.0.0, flowplayer, wordpress, wordpress flowplayer
4 Comments »
Posted by: Buzz in php
An example of getting the current page / post ID, identifying whether the current item is a page or a post, and then appending the results to the content.
All from within a plugin.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
| <?PHP
/*
Plugin Name: Get Page / Post ID using a plugin by D.Busby Saiweb.co.uk
Plugin URI: http://saiweb.co.uk
Description: Identifies the current page/post and appends text to the content
Version: 0.1
Author: David Busby
Author URI: http://saiweb.co.uk
*/
//WP hooks start
add_filter('the_content', 'post_page');
//WP hooks end
function post_page($content){
global $post; //wordpress post global object
if($post->post_type == 'page'){
$content .= '<br /> This item is a page and the ID is: '.$post->ID;
} elseif($post->post_type == 'post') {
$content .= '<br /> This item is a post and the ID is: '.$post->ID;
}
return $content;
}
?> |
Install the above as a plugin i.e. in wp-content/plugins/test/test.php
Head over to your admin menu and enable the plugin, now each page and post will identify itself as a page or post, and provide it’s ID.
There is a lot available in the $post object for a list add
Tags: get, id, page, wordpress
2 Comments »
Posted by: Buzz in flowplayer, php
The 2.1.0.0 release is due for the end of this month, you can follow it’s progress from the TRAC page here: http://trac.saiweb.co.uk/saiweb/milestone/wordpress-flowplayer%202.1.0.0
At the time of writing this intends to close 9 issues / feature requests.
If you have anything you want to see in the next release please leave a comment, or raise a ticket in the trac system.
Cheers
Buzz
Tags: 2.1.0.0, flowplayer, wordpress
No Comments »
Posted by: Buzz in php
Just as a warning and as a poke to say WHY are you not running PHP 5.x yet.
Parsing “” and it seems some multibyte chars to html_entity_decode() in PHP 4.3.10 will cause it to crash, returning random memory contents.
In my case some contents in memory from other sites running on the box were returned.
Tags: crash, php
No Comments »
|
Entries (RSS)