Automatic eval() during string concatenation in old PHP versions?
up vote
0
down vote
favorite
During a security challenge, I came across the following code:
function write($msg){
$content=$msg;
$content=$content . " " . $_SERVER['HTTP_USER_AGENT'];
$fd=fopen("publicFile","a");
fwrite($fd,$content);
fclose($fd);
}
The most popular solution involved replacing the user agent field with some PHP code, e.g.: User-Agent: <?php readfile("somethingInteresting"); ?>
The server on which the challenge was hosted used PHP v5.6.33-0. I wasn't able to reproduce this behaviour on my computer with PHP v7.2.10. The code inside $_SERVER['HTTP_USER_AGENT'] didn't get executed and the contents of "somethingInteresting" weren't written to publicFile, like during the challenge. My question is why? Did they change the way string concatenation works in PHP after 5.6.33? I'm actually surprised it worked during the challenge.
php security
asked Nov 22 at 17:08
Tomasz Kasperczyk
3532627
|
show 4 more comments
up vote
0
down vote
favorite
During a security challenge, I came across the following code:
function write($msg){
$content=$msg;
$content=$content . " " . $_SERVER['HTTP_USER_AGENT'];
$fd=fopen("publicFile","a");
fwrite($fd,$content);
fclose($fd);
}
The most popular solution involved replacing the user agent field with some PHP code, e.g.: User-Agent: <?php readfile("somethingInteresting"); ?>
The server on which the challenge was hosted used PHP v5.6.33-0. I wasn't able to reproduce this behaviour on my computer with PHP v7.2.10. The code inside $_SERVER['HTTP_USER_AGENT'] didn't get executed and the contents of "somethingInteresting" weren't written to publicFile, like during the challenge. My question is why? Did they change the way string concatenation works in PHP after 5.6.33? I'm actually surprised it worked during the challenge.
php security
asked Nov 22 at 17:08
Tomasz Kasperczyk
3532627
I challenge you to enable error_reporting, and elaborate about the used PHP SAPI in both cases. What did you think readfile() to do? Also what does this have to do with eval or security now?
– mario
Nov 22 at 17:17
Not sure how the replacement looked like? $_SERVER[readfile("somethingInteresting")] ? Can you post the replacement code?
– Blackbam
Nov 22 at 17:24
2
There's no way that any version of PHP evaluated any code as part of a string concatenation. I think the point of the security exercise is to show that writing user-input to file without validating it is unsafe - if publicFile was executable (via either the webserver or the command-line), then you've got an arbitrary code execution vulnerability.
– iainn
Nov 22 at 17:40
1
You left out a lot of explanation what that "challenge" was about. The clue is in the filenames. There's no execution of literal strings. ThepublicFilecan store literal PHP code however and might be runnable later on.
– mario
Nov 22 at 17:43
1
@iainn you're right, now I see where the problem lies. We didn't accesspublicFiledirectly - we usedincludeto display it (the whole challenge involved more steps, this was just one of them). The file didn't contain the already evaluated code as I thought. The code got evaluated by theincludestatement later. When I tested it on my computer, I read the file directly... my bad, sorry for wasting your time.
– Tomasz Kasperczyk
Nov 22 at 18:08
|
show 4 more comments
up vote
0
down vote
favorite
up vote
0
down vote
favorite
During a security challenge, I came across the following code:
function write($msg){
$content=$msg;
$content=$content . " " . $_SERVER['HTTP_USER_AGENT'];
$fd=fopen("publicFile","a");
fwrite($fd,$content);
fclose($fd);
}
The most popular solution involved replacing the user agent field with some PHP code, e.g.: User-Agent: <?php readfile("somethingInteresting"); ?>
The server on which the challenge was hosted used PHP v5.6.33-0. I wasn't able to reproduce this behaviour on my computer with PHP v7.2.10. The code inside $_SERVER['HTTP_USER_AGENT'] didn't get executed and the contents of "somethingInteresting" weren't written to publicFile, like during the challenge. My question is why? Did they change the way string concatenation works in PHP after 5.6.33? I'm actually surprised it worked during the challenge.
php security
asked Nov 22 at 17:08
Tomasz Kasperczyk
3532627
During a security challenge, I came across the following code:
function write($msg){
$content=$msg;
$content=$content . " " . $_SERVER['HTTP_USER_AGENT'];
$fd=fopen("publicFile","a");
fwrite($fd,$content);
fclose($fd);
}
The most popular solution involved replacing the user agent field with some PHP code, e.g.: User-Agent: <?php readfile("somethingInteresting"); ?>
The server on which the challenge was hosted used PHP v5.6.33-0. I wasn't able to reproduce this behaviour on my computer with PHP v7.2.10. The code inside $_SERVER['HTTP_USER_AGENT'] didn't get executed and the contents of "somethingInteresting" weren't written to publicFile, like during the challenge. My question is why? Did they change the way string concatenation works in PHP after 5.6.33? I'm actually surprised it worked during the challenge.
php security
php security
asked Nov 22 at 17:08
Tomasz Kasperczyk
3532627
asked Nov 22 at 17:08
Tomasz Kasperczyk
3532627
asked Nov 22 at 17:08
Tomasz Kasperczyk
3532627
asked Nov 22 at 17:08
Tomasz Kasperczyk
3532627
asked Nov 22 at 17:08
Tomasz Kasperczyk
3532627
3532627
I challenge you to enable error_reporting, and elaborate about the used PHP SAPI in both cases. What did you think readfile() to do? Also what does this have to do with eval or security now?
– mario
Nov 22 at 17:17
Not sure how the replacement looked like? $_SERVER[readfile("somethingInteresting")] ? Can you post the replacement code?
– Blackbam
Nov 22 at 17:24
2
There's no way that any version of PHP evaluated any code as part of a string concatenation. I think the point of the security exercise is to show that writing user-input to file without validating it is unsafe - if publicFile was executable (via either the webserver or the command-line), then you've got an arbitrary code execution vulnerability.
– iainn
Nov 22 at 17:40
1
You left out a lot of explanation what that "challenge" was about. The clue is in the filenames. There's no execution of literal strings. ThepublicFilecan store literal PHP code however and might be runnable later on.
– mario
Nov 22 at 17:43
1
@iainn you're right, now I see where the problem lies. We didn't accesspublicFiledirectly - we usedincludeto display it (the whole challenge involved more steps, this was just one of them). The file didn't contain the already evaluated code as I thought. The code got evaluated by theincludestatement later. When I tested it on my computer, I read the file directly... my bad, sorry for wasting your time.
– Tomasz Kasperczyk
Nov 22 at 18:08
|
show 4 more comments
I challenge you to enable error_reporting, and elaborate about the used PHP SAPI in both cases. What did you think readfile() to do? Also what does this have to do with eval or security now?
– mario
Nov 22 at 17:17
Not sure how the replacement looked like? $_SERVER[readfile("somethingInteresting")] ? Can you post the replacement code?
– Blackbam
Nov 22 at 17:24
2
There's no way that any version of PHP evaluated any code as part of a string concatenation. I think the point of the security exercise is to show that writing user-input to file without validating it is unsafe - if publicFile was executable (via either the webserver or the command-line), then you've got an arbitrary code execution vulnerability.
– iainn
Nov 22 at 17:40
1
You left out a lot of explanation what that "challenge" was about. The clue is in the filenames. There's no execution of literal strings. ThepublicFilecan store literal PHP code however and might be runnable later on.
– mario
Nov 22 at 17:43
1
@iainn you're right, now I see where the problem lies. We didn't accesspublicFiledirectly - we usedincludeto display it (the whole challenge involved more steps, this was just one of them). The file didn't contain the already evaluated code as I thought. The code got evaluated by theincludestatement later. When I tested it on my computer, I read the file directly... my bad, sorry for wasting your time.
– Tomasz Kasperczyk
Nov 22 at 18:08
I challenge you to enable error_reporting, and elaborate about the used PHP SAPI in both cases. What did you think readfile() to do? Also what does this have to do with eval or security now?
– mario
Nov 22 at 17:17
I challenge you to enable error_reporting, and elaborate about the used PHP SAPI in both cases. What did you think readfile() to do? Also what does this have to do with eval or security now?
– mario
Nov 22 at 17:17
Not sure how the replacement looked like? $_SERVER[readfile("somethingInteresting")] ? Can you post the replacement code?
– Blackbam
Nov 22 at 17:24
Not sure how the replacement looked like? $_SERVER[readfile("somethingInteresting")] ? Can you post the replacement code?
– Blackbam
Nov 22 at 17:24
2
2
There's no way that any version of PHP evaluated any code as part of a string concatenation. I think the point of the security exercise is to show that writing user-input to file without validating it is unsafe - if publicFile was executable (via either the webserver or the command-line), then you've got an arbitrary code execution vulnerability.
– iainn
Nov 22 at 17:40
There's no way that any version of PHP evaluated any code as part of a string concatenation. I think the point of the security exercise is to show that writing user-input to file without validating it is unsafe - if publicFile was executable (via either the webserver or the command-line), then you've got an arbitrary code execution vulnerability.
– iainn
Nov 22 at 17:40
1
1
You left out a lot of explanation what that "challenge" was about. The clue is in the filenames. There's no execution of literal strings. The
publicFile can store literal PHP code however and might be runnable later on.– mario
Nov 22 at 17:43
You left out a lot of explanation what that "challenge" was about. The clue is in the filenames. There's no execution of literal strings. The
publicFile can store literal PHP code however and might be runnable later on.– mario
Nov 22 at 17:43
1
1
@iainn you're right, now I see where the problem lies. We didn't access
publicFile directly - we used include to display it (the whole challenge involved more steps, this was just one of them). The file didn't contain the already evaluated code as I thought. The code got evaluated by the include statement later. When I tested it on my computer, I read the file directly... my bad, sorry for wasting your time.– Tomasz Kasperczyk
Nov 22 at 18:08
@iainn you're right, now I see where the problem lies. We didn't access
publicFile directly - we used include to display it (the whole challenge involved more steps, this was just one of them). The file didn't contain the already evaluated code as I thought. The code got evaluated by the include statement later. When I tested it on my computer, I read the file directly... my bad, sorry for wasting your time.– Tomasz Kasperczyk
Nov 22 at 18:08
|
show 4 more comments
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53435614%2fautomatic-eval-during-string-concatenation-in-old-php-versions%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53435614%2fautomatic-eval-during-string-concatenation-in-old-php-versions%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
I challenge you to enable error_reporting, and elaborate about the used PHP SAPI in both cases. What did you think readfile() to do? Also what does this have to do with eval or security now?
– mario
Nov 22 at 17:17
Not sure how the replacement looked like? $_SERVER[readfile("somethingInteresting")] ? Can you post the replacement code?
– Blackbam
Nov 22 at 17:24
2
There's no way that any version of PHP evaluated any code as part of a string concatenation. I think the point of the security exercise is to show that writing user-input to file without validating it is unsafe - if publicFile was executable (via either the webserver or the command-line), then you've got an arbitrary code execution vulnerability.
– iainn
Nov 22 at 17:40
1
You left out a lot of explanation what that "challenge" was about. The clue is in the filenames. There's no execution of literal strings. The
publicFilecan store literal PHP code however and might be runnable later on.– mario
Nov 22 at 17:43
1
@iainn you're right, now I see where the problem lies. We didn't access
publicFiledirectly - we usedincludeto display it (the whole challenge involved more steps, this was just one of them). The file didn't contain the already evaluated code as I thought. The code got evaluated by theincludestatement later. When I tested it on my computer, I read the file directly... my bad, sorry for wasting your time.– Tomasz Kasperczyk
Nov 22 at 18:08