PHP cast Type and risk _php tutorial for remote management plug-ins

The type casts in PHP are very similar to those in C: precede the variables to be converted with the target type enclosed in parentheses.

The allowable casts are:

(int), (integer)-Converted to integral type

(bool), (Boolean)-converted to Boolean

(float), (double), (real)-converts to floating-point type

(string)-converts to a string

(array)-Convert an array

(object)-Convert to Object

Note that spaces and tabs are allowed inside the parentheses

You can also use Settype (mixed var, string type) to cast.

The remote administration plug-in is a popular tool for WordPress site administrators who allow users to perform the same actions on multiple sites at the same time, such as updating to the latest release or installing plug-ins. However, in order to do this, the client plug-in needs to give the remote user very large permissions. Therefore, it is important to ensure that the communication between the Management Server and the client plug-in is secure and cannot be falsified by the attacker. This article will talk about several available plug-ins and exploit their weaknesses, and attackers can even compromise the sites that run these plugins completely.

MANAGEWP, INFINITEWP, and CMS Commander

These three services have the same client-side plug-in base code (visual inspection was originally implemented by the MANAGEWP, and then the other two tuned them), so they all have signature bypass vulnerabilities and can cause remote code execution.

The Management Server registers a client plug-in's private key, which computes the message authentication code for each message, rather than requiring the user to provide the administrator credentials [Mac, we usually see it as the MAC address of the hardware, here is message authentication code]. A message digest is generated when a message is created by using the Message digest algorithm of the shared key. The Mac is then appended to the message, which is then sent out, the recipient receives the message using the shared secret key to calculate, generates MAC2, and compares with MAC1. Message digest is used to verify the authenticity and integrity of the message [All students who have learned cryptography should know], is a good way to ensure the security of communications, but the three services of the client plug-in implementation of the defect caused a serious vulnerability.

An incoming message authenticated by helper.class.php is as follows:

$signature is the MAC sent with the message//$data are part of the message if (MD5 ($data. $this->get_random_signat Ure ()) = = $signature) {//valid message}

Using non-strict equals means that the type "spoofing" [type conversion] occurs before the comparison. The output of the MD5 () function is always a string, but if $signature is an integer, then the type conversion that occurs at the time of comparison can easily forge a matching Mac. For example, if a real Mac starts with "0" or a non-numeric character, then 0 can match, and if it's "1xxx", then the integer 1 will match, once and again. [This is actually a feature of PHP, of course, other languages will also have, when a string and a number is not strictly equal to the comparison, if the first character is a number will be converted to the corresponding integer to compare, if it is a non-0-9 character, it will be treated as 0, Description of Php.net: If you compare a number and a string or compare a string that involves a numeric content, the string is converted to a numeric value and compared to a numeric value.

The string is converted to a numeric value:

When a string is taken as a numeric value, the result and type are as follows:

If the string does not contain '. ', ' e ' or ' e ' and its numeric value is within the range of the integral type (as defined by Php_int_max), the string will be evaluated as an integer. All other cases are evaluated as float.

The starting part of the string determines its value. If the string starts with a valid numeric value, the value is used. Otherwise its value is 0 (0). The legal value is represented by an optional sign, followed by one or more digits (which may have decimal points), followed by an optional exponential portion. The exponential part is composed of one or more digits followed by ' e ' or ' e '.

$signature is the MAC sent with the message

$data is part of the message

if (MD5 ($data. $this->get_random_signature ()) = = $signature) {

Valid message}

Unfortunately, an attacker could provide an integer as a signature. init.php, the incoming request will be decoded using Base64_decode (), and the result is deserialized. The use of unserialize () means that the type of input data can be controlled, and a forged serialization message is as follows:

A:4:{s:9: "Signature"; I:0;s:2: "id"; I:100000;s:6: "Action"; s:16: "Execute_php_code"; s:6: "Params"; A:2:{s:8: " Username "; s:5:" admin "; s:4:" Code "; s:25:" Exec (' touch/tmp/owned '); ";}}

This message uses the integer 0 as the signature and then executes any PHP code using the Execute_php_code provided by the plug-in.

$signature = 0; $data is the action concatenated with the message ID $data = ' Execute_php_code '. 100000; if (MD5 ($data. $this->get_random_signature ()) = = $signature) {//valid message if the output of//MD5 () doesn ' t star T with a digit}

This fake example may not be used directly, first of all, the ID of the key value needs than the previous legitimate message values greater [using the increased message ID used to prevent replay attacks, today both request forgery, and replay, which reminds me of CSRF, cross-site request forgery, there is no man-in-the-middle attack it? Second, there is an integer to match the signature, and this two-point requirement can be broken through brute force.

For i from 100,000 to 100,500:for J from 0 to 9:submit request with ID I and signature j

The above pseudo-code attempts to send with a very large ID worthy of a false message, and 10 separate digital fingerprint matches for each ID [as mentioned before, for a string, as long as a number can be matched in comparison, here from 0-9 because every situation can be encountered].

This flaw can be fixed by using the congruent operator [= = =] and checking the incoming fingerprint. These plug-in services are fixed by using strict equality operators [Php.net's description: A===b, A and B values are equal, and the types are equal; A==b, the value is equal after the type conversion occurs].

There are other problems, but they haven't taken action yet. First, the practice is to have weaknesses [keys appended to $data and then hashed], should use hmac[hash-based message authentication Code, with a key and a message as input, generate a message digest as output]. Second, only the action and message ID used for the operation are used to create the signature. This means that an active network attacker can change the parameters in the message and the signature is still valid [such as changing the Execute_php_code message to execute arbitrary code]. For protection, your Mac should contain an entire message.

[Note that the MD5-based message digest is a fallback that can be used if these plugins use Openssl_verify (); ***2014-04 released the OpenSSL 1.0.f Heartbleed vulnerability known as the century-class vulnerability * * *]

Worpit

Worpit is another remote management service, but it uses a client plug-in built from scratch, and it also has a forced type conversion vulnerability that could allow an attacker to log on with administrator privileges.

The plugin provides a way for remote administrator to log in, using only the temporary token values that the Woprit delivery system can configure. This plug-in checks to see if the token value provided in the request matches the value stored in the database.

if ($_get[' token ']! = $oWpHelper->gettransient (' Worpit_login_token ')) {die (' worpiterror:invalid token ');}

Tokens are removed from a database that is used once. This means that most of the time there are no tokens in the database. Therefore, the call to the Gettransient () method may return false. The non-strict comparison is that this means that any "Falsey value, such as String 0, will be considered a valid token." An example URL is logged in as an administrator:

Once the token is used, it is deleted from the database, which means that most of the time there is no token in the database. Therefore, the call to the Gettransient () method is likely to return false. Non-strict comparisons are also used, which means that any value equivalent to false, such as String 0, will be treated as a valid token, logged in as an administrator example: Http://victim/?worpit_api=1&m=login&token =0

At this point, the attacker's site is under the control of the attacker, who has the authority to install malicious plugins or modify existing plugins.

The fix here is to use!== and perform additional checks and retrieve from the database.

Conclusion:

Be sure to remember to check that the user entered the expected type and use it in a security-critical function for strict comparisons, such as checking the authentication token.

http://www.bkjia.com/PHPjc/752677.html www.bkjia.com true http://www.bkjia.com/PHPjc/752677.html techarticle The type casts in PHP are very similar to those in C: precede the variables to be converted with the target type enclosed in parentheses. The allowable casts are: (int), (integer)-Convert to int ...

