irsl / php-bypass-disable-functions

Demo project how to bypass the disable_functions security control of PHP on Linux

php-bypass-disable-functions

Demo project how to bypass the disable_functions security control of PHP on Linux, where processes can inspect and even write their own memory via the special /proc/self/map file via standard file operations (open/seek/read/write).

Tested on PHP 7.3.5, x86_64 Linux

See also: https://seclists.org/bugtraq/2019/May/52

how to use

regularuser@7981d86dd9aa:/$ ./php-7.3.5-vanilla/sapi/cli/php -d 'disable_functions=system' disfunpoc.php

Warning: system() has been disabled for security reasons in /repo-shared/disabled_functions/disfunpoc.php on line 2
uid=1000(regularuser) gid=1000(regularuser) groups=1000(regularuser)

php-bypass-disable-functions's Issues

Doesn't work on php8

Hello,

I've tried with php-8.2.10 (on NetBSD) and found that, contrary to php-7.4.11, a disabled function system() is not visible at all:

php 7:

php7maschine$ php --rf system 
Function [ <internal:standard> function system ] {

  - Parameters [2] {
    Parameter #0 [ <required> $command ]
    Parameter #1 [ <optional> &$return_value ]
  }
}

php7machine$ php -d disable_functions=system --rf system
Function [ <internal:standard> function system ] {
}
php7maschine$

php8

php8machine$ php --rf system
PHP Warning:  Module "curl" is already loaded in Unknown on line 0
PHP Warning:  Module "pgsql" is already loaded in Unknown on line 0
Function [ <internal:standard> function system ] {

  - Parameters [2] {
    Parameter #0 [ <required> string $command ]
    Parameter #1 [ <optional> &$result_code = null ]
  }
  - Return [ string|false ]
}

php8machine$ php -d disable_functions=system --rf system
PHP Warning:  Module "curl" is already loaded in Unknown on line 0
PHP Warning:  Module "pgsql" is already loaded in Unknown on line 0
Exception: Function system() does not exist
php8machine$

does this address your complaint?

Please ignore

Please ignore