PHP code Audit--2, PHP Code audit PHP Environment Introduction

This article to share the content of the PHP environment is a brief introduction, interested friends can see, but also to help students need a little reference

Objective

The results of code execution in different environments can be very different, possibly because of a configuration problem that can be exploited by a very high-risk vulnerability, or you may have found a vulnerability because of your configuration problem, and you have been unable to construct the successful exploit code for a long time. However, in different versions of PHP configuration directives will also have the same place, the new version may increase or remove some of the instructions, change the instruction default settings or fixed settings command, so we need to be very familiar with the PHP version of the configuration files in the core instructions, To be able to efficiently tap into high-quality vulnerabilities.

Php_ini_* Constants

Constant	Meaning
Php__ini__user	This configuration option can then be set in the user's PHP script or in the Windows registry
Php__ini__perdir	This configuration option can be php.ini again. Set in htaccess or http.conf
Php__ini__system	This setting option can be set in php.ini or http.conf
Php__ini__all	This configuration option can be set anywhere
PHP.ini only	This setting option can only be set in php.ini

PHP configuration file instructions up to hundreds of, there is no introduction, if you are interested in this area can go to the PHP configuration official description file to see the specific content: http://www.php.net/manual/zh/ini.list.php

Common basic settings for PHP

(1) Open_basedir settings

Open_basedir can restrict the directories that the application can access, check whether the Open_basedir is set, and of course some are set through the Web server, for example: Apache php_admin_value,nginx+fcgi is controlled by Conf.

(2) Allow_url_fopen settings

If Allow_url_fopen=on, then PHP can read remote files to operate, this is easily exploited by attackers.

(3) Allow_url_include settings

If Allow_url_include=on, then PHP can contain remote files that can cause serious vulnerabilities.

(4) Safe_mode_exec_dir settings

This option controls the directory of external commands that PHP can invoke, and if the PHP program has a call to external commands, then the directory of external commands can be used to control the risk of the program.

(5) MAGIC_QUOTE_GPC settings

This option escapes the special characters that are submitted to the parameter, and it is recommended to set Magic_quote_gpc=on

(6) Register_globals settings

Turning on this option will cause PHP to register all externally committed variables as global variables, and the consequences are quite serious.

(7) Safe_mode settings

Safe_mode is an important security feature of PHP, it is recommended to open

(8) Session_use_trans_sid settings

If you start session_use_trans_sid, it will cause PHP to pass the session ID through the URL, which can cause the attacker to easily hijack the current session or trick the user into using an existing session that has been controlled by the attacker.

(9) Display_errors settings

If this option is enabled, PHP will output all error or warning messages that an attacker can use to get sensitive information such as the Web root path.

(Ten) expose_php settings

If you start the expose_php option, then PHP explains that each response it generates will contain the version of PHP installed on the host system. Knowing the version of PHP running on a remote server allows an attacker to enumerate known exploits against the system, greatly increasing the chances of a successful attack.

(one) magic_quotes_sybase (automatic filtering of magic quotes)

The magic_quotes_sybase directive is used to automatically filter special characters, and when set to ON, it overrides the Magic_quotes_gpc=on configuration, which means that gpc=on is not effective when configured in a timely manner. this directive is consistent with what GPC has in common, that is, the Post\get\cookie is processed.

(disable_functions) (disable function)

In a formal production environment, in order to run PHP more safely, you can also use the Disable_functions directive to suppress the use of some sensitive functions. When you want to use this directive to prohibit some dangerous functions, remember to add the DL () function to the block list, because an attacker could use the DL () function to load a custom PHP extension to break the limits of the Disable_function directive.