mailing list archives
Windows PHP 4.x "0-day" buffer overflow
From: <mercenary () hushmail com>
Date: Wed, 4 Jan 2006 19:52:52 -0800
-----BEGIN PGP SIGNED MESSAGE-----
Buffer Overflow in PHP MySQL functions
Low - Remote code execution on some systems
The function is not normaly exposed to external users via input data
II. AFFECTED VERSIONS
4.x Branch under Windows
PHP contains many built-in functions to allow a developer to
interface with MySQL servers. One of these, mysql_connect()
contains functionality to allow a user to connect via named pipes
to a server.
The format of the mysql_connect function is as follows:
The host field can accept a host in the following format when PHP
is used on a Windows system:
Where "pipe" is the named pipe to use. Within the internal code,
this pipe name is later copied into a 257 byte internal character
buffer. By supplying a long pipe variable, we are able to preform a
classical stack based buffer overflow attack. From
\ext\mysql\libmysql\libmysql.c line 216:
HANDLE create_named_pipe(NET *net, uint connect_timeout, char
char szPipeName [ 257 ];
sprintf( szPipeName, "\\\\%s\\pipe\\%s", host, unix_socket);
The variable unix_socket is the value of the host string after the
trailing colon (:), if it exists.
Because we will be overflowing several pointers, the address of a
valid memory location must also be written to memory 4 bytes after
our replacement EIP. When our EIP is restored, ESI will contain a
pointer to the value of the "username" variable. This can be used
as a location to store our shellcode, as it is a reliable location.
This exploit was designed to work with PHP versions 4.3.10 and
4.4.0 under Windows XP SP 1. If another operating system is used,
the replacement EIP must be changed.
The replacement EIP is written 261 bytes into our string. For this
exploit, I used a CALL ESI from ws2_32.dll from Windows XP SP1.
The replacement ESI is simply the base of the PHP image. Locations
after this address will be overwritten with some internal data.
Our shellcode is written into the $user variable. $two is used to
prevent $user from being truncated with a MySQL error message.
The length of unix_socket should be verified prior to use. In
addition, the string should be formatted using a safe function such
as snprintf, followed by a hardcoded null terminator.
POC is attached.
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.4
-----END PGP SIGNATURE-----
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Windows PHP 4.x "0-day" buffer overflow mercenary (Jan 05)