Prevention of PHP WebShell from the PHP kernel layer

By coffee (k4kup8_0x00004_gmail.com)

[Directory]

1. Brief Introduction
2. php Execution Process
3. lifecycle of php
4. php source code analysis and functional code implementation
5. Summary
6. References

I. Brief Introduction

Php-specific runtime environments, certain php function defects, and common php functions can be used to implement a variety of php
The scanwebshell of webshell and php is not too powerful. To maximize the functionality of php webshell,
Directory, command, database, and other operations are implemented based on php code. Function execution parameters of related functional php Functions
Extract the number and then make a judgment so that php webshell can be prevented in essence.
It maximizes security. Here we will introduce how to implement this idea by writing php extensions. Of course, you can try again if necessary.
Compile the php source code.

First, let's take a look at the php Execution Process and php lifecycle. Next, we will analyze the php source code of a specific function.
To implement functional code.

2. php Execution Process

2.1 bytes

Convert the PHP code to Tokens. For details, see the code Zend/zend_language_scanner.l.

2.2 parser

Convert Tokens to an expression. For details, see the code Zend/zend_language_parser.y.

2.3 compile

Compile the expression into opcode. Opcode is stored in op_array.

2.4 execute

Zend Engine calls zend_execute to execute op_array and output the result.

Iii. lifecycle of php

3.1 STARTUP

1. initialize the engine and core components.
2. parse php. ini.
3. initialize the static building module (MINIT ).
4. initialize the sharing module (MINIT ).

3.2 ACTIVATION

1. initialize environment variables and variables.
2. Activate the static build module (RINIT ).
3. Activate the sharing module (RINIT ).

3.3 RUNTIME

1. Compile and execute the file specified by the auto_prepend_file option in php. ini.
2. Compile and execute the requested file.
3. Compile and execute the file specified by the auto_append_file option in php. ini.

3.4 DEACTIVATION

1. Call the exit function specified by the user.
2. Destroy the object instance.
3. RSHUTDOWN ).
4. Clear the output.
5. Clean up the environment.
6. Release the remaining non-persistent memory.

3.5 SHUTDOWN

1. Disable all started modules (MSHUTDOWN ).
2. Disable the engine.

4. php source code analysis and functional code implementation

Php functions can be divided into two types: Zend functions, which have a small number, such as eval functions. Second
It is written by the PHP_FUNCTION macro. There are many such functions, such as system functions. The implementation of the two types of functions
The parameter methods for receiving and running operations are also different. For example, to process eval functions, rewrite zend_compile_string,
The HashTable operation is performed for the system function. The following uses eval functions and system functions as examples for analysis and generation.
Code implementation.

4.1 eval function code analysis and code implementation

First, let's look at how the eval function is implemented in php source code. Some code is as follows:

// PHPSRC/Zend/zend_vm_def.h

If (inc_filename-> type! = IS_STRING ){
Tmp_inc_filename = * inc_filename;
Zval_copy_ctor (& tmp_inc_filename );
Convert_to_string (& tmp_inc_filename );
Inc_filename = & tmp_inc_filename;
}

Case ZEND_EVAL :{
/* Call the zend_make_compiled_string_description function */
Char * eval_desc = zend_make_compiled_string_description ("eval ()" d code "TSRMLS_CC );
/* Call the zend_compile_string function */
New_op_array = zend_compile_string (inc_filename, eval_desc TSRMLS_CC );
Efree (eval_desc );
}
/* Run op_array */
Zend_execute (new_op_array TSRMLS_CC );

// PHPSRC/Zend/zend. c

# Define COMPILED_STRING_DESCRIPTION_FORMAT "% s (% d): % s"
ZEND_API char * zend_make_compiled_string_description (char * name TSRMLS_DC)
{
Zend_spprintf (& compiled_string_description, 0, COMPILED_STRING_DESCRIPTION_FORMAT, cur_filename, cur_lineno, name );
Return compiled_string_description; // The returned value contains the "eval ()" d code "string.
}

// PHPSRC/Zend/zend_compile.c

ZEND_API zend_op_array * (* zend_compile_string) (zval * source_string, char * filename TSRMLS_DC );

Zend_compile_string is a function pointer. Next, let's take a look at the zend_compile_string operation during engine initialization.

Int zend_startup (zend_utility_functions * utility_functions, char ** extensions, int start_builtin_functions)
{
Zend_compile_string = compile_string; // assign a value to the address of the zend_compile_string Function
You only need to check whether op_array contains the "eval ()" d code "string to determine whether the eval function is being executed.
When the engine is initialized, the address of the compile_string function is assigned to zend_compile_string by default,
The compile_string function returns a pointer to zend_op_array. If you can
Zend_compile_string is rewritten to achieve hijacking. According to the lifecycle of php
Zend_compile_string should be rewritten in the STARTUP or ACTIVATION stages, and php Extension
The PHP_MINIT_FUNCTION and PHP_RINIT_FUNCTION macros used are in STARTUP and ACTIVATION respectively.
Why are these two phases? Let's take a look at the definition of the PHP_MINIT_FUNCTION macro in php. h code.

# Define PHP_MINIT_FUNCTION ZEND_MODULE_STARTUP_D
// ZEND_MODULE_STARTUP_D is defined in zend_API.h
# Define ZEND_MODULE_STARTUP_D (module) int ZEND_MODULE_STARTUP_N (module) (INIT_FUNC_ARGS)
// ZEND_MODULE_STARTUP_N is defined in zend_API.h.
# Define ZEND_MODULE_STARTUP_N (module) zm_startup _ # module
// INIT_FUNC_ARGS is defined in zend_modules.h
# Define INIT_FUNC_ARGS int type, int module_number TSRMLS_DC
-------------------------------------------------------------------------------

The prototype of PHP_MINIT_FUNCTION (module) is:

-- Code -------------------------------------------------------------------------
Zm_startup_module (int type, int module_number TSRMLS_DC)
-------------------------------------------------------------------------------

The prototype of the same PHP_RINIT_FUNCTION (module) is:

-- Code -------------------------------------------------------------------------
Zm_activate_module (int type, int module_number TSRMLS_DC)
-------------------------------------------------------------------------------
The code for intercepting and analyzing eval function running parameters is as follows:

# Define OVECCOUNT 30
/* The specific regular expression must be written according to specific requirements. The following regular expression is only used for testing */
# Define eval_regex_value "(chr \ (\ d *? \) | Base64_decode \ (| eval | gzinflate \ (| system | shell_exec | popen | pclose | proc_close | proc_get_status | proc_nice |

Proc_terminate | exec | passthru | show_source | escapeshellcmd | escapeshellarg system | shell_exec | popen | pclose | proc_open | proc_close | proc_get_status | proc_nice | proc_terminexec |

Passthru | show_source | escapeshellcmd | escapeshellarg) \ ([{} "$ \ w \ s] *? \));).*? "

Static zend_op_array * (* old_compile_string) (zval * source_string, char * filename TSRMLS_DC );
Static zend_op_array * safe_compile_string (zval * source_string, char * filename TSRMLS_DC );

PHP_RINIT_FUNCTION (safe) // PHP_MINIT_FUNCTION (safe) can also be
{
Safe_hook_execute ();
Return SUCCESS;
}

PHP_RSHUTDOWN_FUNCTION (safe) // PHP_MSHUTDOWN_FUNCTION (safe) can also be
{
Safe_unhook_execute ();
Return SUCCESS;
}

Int matchpattern (char * src, char * pattern, int I) // Regular Expression matching function
{
Pcre * re;
Const char * error;