Common vulnerabilities and code examples in PHP programming, PHP programming vulnerability examples_PHP tutorial

Common vulnerabilities and code examples in PHP programming, examples of PHP programming vulnerabilities

It is not impregnable. With the widespread use of PHP, some hackers are constantly looking for trouble with PHP. Attacking through PHP program vulnerabilities is one of them. In this section, we will analyze the security of PHP from the aspects of global variables, remote files, file uploads, library files, Session files, data types and error-prone functions.

How to attack through global variables?

Variables in PHP do not need to be declared in advance, they are automatically created the first time they are used, and their types are automatically determined based on the context. From a programmer's perspective, this is undoubtedly an extremely convenient approach. Once a variable is created, it can be used anywhere in the program. The result of this feature is that programmers rarely initialize variables.

Obviously, the main function of PHP-based applications generally accepts user input (mainly form variables, uploaded files, cookies, etc.), then processes the input data, and then returns the results to the client browser . In order to make it as easy as possible for PHP code to access user input, PHP actually treats this input data as global variables.

For example:

Copy code The code is as follows:

This will display a text box and submit button. When the user clicks the submit button, "test.php" will process the user's input. When "test.php" is run, "$hello" will contain the data entered by the user in the text box. From here we should see that the attacker can create arbitrary global variables according to his wishes. If the attacker does not call "test.php" through form input, but directly enters http://server/test.php?hello=hi&setup=no in the browser address bar, then not only "$hello" will be created , "$setup" is also created.

The following user authentication code exposes security issues caused by PHP's global variables:
PHP code

Copy code The code is as follows:

if ($pass == "hello")
$auth = 1;
...
if ($auth == 1)
echo "some important information";
?>

The above code first checks whether the user's password is "hello". If it matches, set "$auth" to "1", which means the authentication is passed. Afterwards, if "$suth" is "1", some important information will be displayed.

This code assumes that "$auth" is empty when no value is set, but an attacker can create any global variable and assign a value, through something like "http://server/test.php?auth=1" Method, we can completely trick this code into believing that we have authenticated it.

Therefore, in order to improve the security of PHP programs, we cannot trust any variables that are not clearly defined. This can be a very difficult task if there are many variables in the program.

A common protection method is to check the variables in the array HTTP_GET[] or POST_VARS[], which depends on our submission method (GET or POST). When PHP is configured with the "track_vars" option turned on (which is the default), user-submitted variables are available in global variables and the array mentioned above.

But it is worth mentioning that PHP has four different array variables used to process user input. The HTTP_GET_VARS array is used to process variables submitted in GET mode, the HTTP_POST_VARS array is used to process variables submitted in POST mode; the HTTP_COOKIE_VARS array is used to process variables submitted as cookie headers, and for the HTTP_POST_FILES array (provided by relatively new PHP), it is completely An optional way for users to submit variables. A user request can easily store variables in these four arrays, so a secure PHP program should check these four arrays.

How to attack via remote files?

PHP is a feature-rich language that provides a large number of functions to make it easy for programmers to implement specific functions. But from a security perspective, the more features you have, the harder it is to keep it secure. Remote files are a good example of this problem:

Copy code The code is as follows:

if (!($fd = fopen("$filename", "r"))
echo("Could not open file: $filename＜BR＞n");
?>

The above script attempts to open the file "$filename" and displays an error message if it fails. Obviously, if we can specify "$filename", we can use this script to browse any file on the system. However, a less obvious feature of this script is that it can read files from any other WEB or FTP site. In fact, most of PHP's file handling functions handle remote files transparently.

For example:
If "$filename" is specified as "http://target/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir"

The above code actually exploits the unicode vulnerability on the host target to execute the dir command. This makes support for remote files' include(), require(), include_once() and require_once() more interesting in context. The main function of these functions is to include the contents of specified files and interpret them according to PHP code. They are mainly used on library files.

For example:

Copy code The code is as follows:

include($libdir . "/languages.php");
?>

In the above example, "$libdir" is usually a path that has been set before executing the code. If the attacker can prevent "$libdir" from being set, then he can change this path. But the attacker can't do anything because they can only access the file languages.php in the path they specify (the "Poisonnull byte" attack in Perl has no effect on PHP). But with support for remote files, attackers can do anything. For example, an attacker could place a file languages.php on a server with the following content:

Copy code The code is as follows:

passthru("/bin/ls /etc");
?>

Then set "$libdir" to "http:///", so that we can execute the above attack code on the target host, and the contents of the "/etc" directory will be returned to the customer as a result in the browser.

It should be noted that the attack code will not execute its own PHP program on the server where it is located (that is, evilhost). Otherwise, the attack code will attack the server where it is located instead of executing on the target server.

How to attack via file upload?

PHP automatically supports file upload based on RFC 1867. Let’s look at the following example:

Copy code The code is as follows:

The above code allows the user to select a file from the local machine. When submit is clicked, the file will be uploaded to the server. This is obviously a useful feature, but the way PHP responds would make this feature unsafe. When PHP first receives such a request, even before it starts parsing the called PHP code, it will first accept the file from the remote user and check whether the length of the file exceeds the value defined by the "$MAX_FILE_SIZE variable". If it passes these For testing, the file will be stored in a local temporary directory.
Therefore, an attacker can send arbitrary files to the host running PHP, and the files will already be stored on the server before the PHP program decides whether to accept the file upload.

Let's consider a PHP program that handles file uploads. As we said above, the file is received and stored on the server (the location is specified in the configuration file, usually /tmp), and the extension is usually random. , similar to the form of "phpxXuoXG". The PHP program needs to upload the file's information in order to process it, and this can be done in two ways, one that was already used in PHP3, and the other that was introduced after we made a security advisory on the previous method.

Most PHP programs still use the old way to handle uploaded files. PHP sets four global variables to describe uploaded files, such as the above example:

Copy code The code is as follows:

$hello = Filename on local machine (e.g "/tmp/phpxXuoXG")
$hello_size = Size in bytes of file (e.g 1024)
$hello_name = The original name of the file on the remote system (e.g"c:\temp\hello.txt")
$hello_type = Mime type of uploaded file (e.g "text/plain")

Then, the PHP program starts processing the file specified according to "$hello". The problem is that "$hello" is not necessarily a variable set by PHP, any remote user can specify it. If we use the following:

http://vulnhost/vuln.php?hello=/etc/passwd&hello_size=10240&hello_type=text/plain&hello_name=hello.txt

leads to the following PHP global variables (of course POST method is also possible (even Cookie)):

Copy code The code is as follows:

$hello = "/etc/passwd"
$hello_size = 10240
$hello_type = "text/plain"
$hello_name = "hello.txt"

The above form data just meets the variables expected by the PHP program, but at this time the PHP program no longer processes the uploaded file that should be on the uploader's local machine, but processes "/etc/passwd" on the server (usually will result in content exposure) files. This attack can be used to expose the contents of any sensitive file.

The new version of PHP uses HTTP_POST_FILES[] to determine the uploaded file, and also provides many functions to solve this problem. For example, there is a function to determine whether a file is actually uploaded. But in fact there must be many PHP programs that still use the old method, so they are also vulnerable to this attack.

As a variant of the file upload attack method, let’s take a look at the following piece of code:

Copy code The code is as follows:

if (file_exists($theme)) // Checks the file exists on the local system (noremote files)
include("$theme");
?>

If an attacker can control "$theme", it is obvious that he can use "$theme" to read any file on the remote system. The attacker's ultimate goal is to execute arbitrary instructions on the remote server, but he cannot use the remote file, so he must create a PHP file on the remote server. This may seem impossible at first, but file uploading does this for us. If the attacker first creates a file on the local machine containing PHP code, and then creates a form containing a file field named "theme" , and finally use this form to submit the created file containing PHP code to the above code through file upload. PHP will save the file submitted by the attacker and set the value of "$theme" to the file submitted by the attacker. In this way, the file_exists() function will pass the check and the attacker's code will be executed.
After gaining the ability to execute arbitrary instructions, the attacker obviously wants to escalate privileges or expand the results, which requires some tool sets that are not available on the server, and file uploading once again helps the attacker. An attacker can use the file upload function to upload tools, store them on the server, and then use their ability to execute commands, use chmod() to change the permissions of the file, and then execute it. For example, an attacker can bypass the firewall or IDS to upload a local root attack program and then execute it, thus gaining root privileges.

How to attack through library files?

As we discussed earlier, include() and require() are mainly to support the code base, because we usually put some frequently used functions into a separate file, and this independent file is the code base. When we need to use the functions, we only need to include this code library into the current file.

Initially, when people developed and released PHP programs, in order to distinguish the code base from the main program code, they usually set a ".inc" extension for the code base file, but they soon discovered that this was a mistake, because Such files cannot be correctly parsed into PHP code by the PHP interpreter. If we directly request such a file on the server, we will get the source code of the file. This is because when PHP is used as an Apache module, the PHP interpreter determines whether to parse it into PHP based on the extension of the file. of code. The extension is specified by the site administrator, usually ".php", ".php3" and ".php4". If important configuration data is contained in a PHP file without the appropriate extension, it is easy for a remote attacker to obtain this information.

The simplest solution is to specify a PHP file extension for each file. This can effectively prevent the leakage of source code, but it also creates new problems. By requesting this file, the attacker It is possible to cause code that should be running in the context to run independently, which can lead to all the attacks discussed previously.

Here is an obvious example:

Copy code The code is as follows:

In main.php:
$libDir = "/libdir";
$langDir = "$libdir/languages";
... 
include("$libdir/loadlanguage.php":
?>

In libdir/loadlanguage.php:
... 

include("$langDir/$userLang");
?>

When "libdir/loadlanguage.php" is called by "main.php" it is quite safe, but because "libdir /loadlanguage" has a ".php" extension, a remote attacker can directly request this file. And the values ​​of "$langDir" and "$userLang" can be specified arbitrarily.

How to attack through Session file?

PHP 4 or newer versions provide support for sessions, whose main function is to save status information between pages in the PHP program. For example, when a user logs in to the website, the fact that he logged in and the information about who logged in to the website will be saved in the session. When he browses around the website, all PHP code can obtain this state. information.

In fact, when a session is started (actually set in the configuration file to automatically start on the first request), a random "session id" is generated, if the remote browser is always sending If you submit this "session id" when requesting, the session will be maintained. This is easily accomplished via cookies, or by submitting a form variable (containing the "session id") on each page. PHP programs can use session to register a special variable. Its value will be stored in the session file after each PHP script ends, and will also be loaded into the variable before each PHP script starts. Here is a simple example:

Copy code The code is as follows:

session_destroy(); // Kill any data currently in the session
$session_auth = "shaun";
session_register("session_auth"); // Register $session_auth as a session variable
?>

New versions of PHP will automatically set the value of "$session_auth" to "shaun". If they are modified, future scripts will automatically accept the modified values. This is indeed a problem for the stateless Web. A great tool, but we should also be careful.

An obvious question is to ensure that the variable does come from the session. For example, given the above code, if the subsequent script looks like this:

Copy code The code is as follows:

if (!emptyempty($session_auth))
// Grant access to site here
?>

The above code assumes that if "$session_auth" is assigned a value, it is assigned from the session, not from user input. If the attacker assigns the value through form input, he can gain access to the site. Note that the attacker must register the variable in the session before using this attack method. Once the variable is put into the session, it will overwrite any form input.

Session data is generally saved in a file (the location is configurable, usually "/tmp"). The file name is generally in the form of "sess_". This file contains variable names, variable types, variable values ​​and some other data. In a multi-host system, because the file is saved as the user running the web server (usually nobody), a malicious site owner can create a session file to gain access to other sites, and even inspect the session file. sensitive information in.

The Session mechanism also provides another convenience for attackers to save their own input in files on the remote system. For the above example, the attacker needs to place a file containing PHP code on the remote system. If this cannot be done using file upload, he usually uses session to assign a value to a variable according to his own wishes, and then guesses the session file. location, and he knows that the file name is "php", so he only needs to guess the directory, and the directory is usually "/tmp".

In addition, the attacker can arbitrarily specify the "session id" (such as "hello"), and then use this "session id" to create a session file (such as "/tmp/sess_hello"), but the "session id" can only be A combination of letters and numbers.

How to attack by data type?

PHP has loose data types, and the types of variables depend on the context in which they are located. For example: "$hello" starts as a string variable with a value of "", but during evaluation, it becomes an integer variable "0", which may sometimes lead to unexpected results. If the value of "$hello" is different between "000" and "0", the result returned by empty() will not be true.

Arrays in PHP are associative arrays, that is to say, the index of the array is of string type. This means that "$hello["000"]" and "$hello[0]" are also different.

The above issues should be carefully considered when developing a program. For example, we should not test whether a variable is "0" in one place and use empty() to verify it in another place.

How to attack via error-prone functions? The following is a more detailed list of error-prone functions:

Copy code The code is as follows:

1.
2. require(): Read the contents of the specified file and interpret it as PHP code
3. include(): Same as above
4. eval(): Execute the given string as PHP code
5. preg_replace(): When used with the "/e" switch, the replacement string will be interpreted as PHP code
6.
7.
8. exec(): Execute the specified command and return the last line of the execution result
9. passthru(): Execute the specified command and return all results to the client browser
10. ``: Execute the specified command and return all results to an array
11. system(): Same as passthru(), but does not process binary data
12. popen(): Execute the specified command and connect the input or output to the PHP file descriptor
13. 
14.
15. fopen(): Open the file and correspond to a PHP file descriptor
16. readfile(): Read the content of the file and then output it to the client browser
17. file(): Read the entire file content into an array

How to enhance the security of PHP?

All the attacks we introduced above can be implemented well against the default installation of PHP4, but the configuration of PHP is very flexible. By configuring some PHP options, it is entirely possible for us to resist some of these attacks. Below we classify some configurations according to the difficulty of implementation:

Copy code The code is as follows:

*Low difficulty
**Low to medium difficulty
***Medium to High Difficulty
****High difficulty

If you use all the options provided by PHP, then your PHP will be very safe, even with third-party code, because many of its features are no longer available.

**** Set "register_globals" to "off"

This option will disable PHP from creating global variables for user input, that is, if the user submits the form variable "hello", PHP will not create "$hello", but only create "HTTP_GET/POST_VARS['hello'] ". This is an extremely important option in PHP. Turning off this option will bring great inconvenience to programming.

*** Set "safe_mode" to "on"

Turn this option on and the following restrictions will be added:

1． Limit which commands can be executed
2. Limit which functions can be used
3． File access restrictions based on script ownership and target file ownership
4. Disable file upload function

This is a "great" option for ISPs, and it also greatly improves PHP security.

** Set "open_basedir"

This option can prohibit file operations outside the specified directory, effectively eliminating attacks on local files or remote files by include(), but you still need to pay attention to attacks on file uploads and session files.

** Set "display_errors" to "off" and set "log_errors" to "on"

This option disables error messages from being displayed on the web page and instead records them in a log file, which can effectively resist attackers from detecting functions in the target script.

* Set "allow_url_fopen" to "off"

This option disables the remote file function.

Copy code The code is as follows:

//Here allow_url_fopen Note, I saw it on jnc blog, you can use

include('\myiptest.php');
?>

include('//myiptest.php');
?>

Come to spare?

php network programming technology and example code

It has been sent to your email. If you have not received it, just send a letter to my email address qsf.zzia@qq.com to request it again.

Can you send me the source code of typical modules and examples of PHP network programming

www.w3school.com.cn/php/
This website feels good. I usually search for relevant information on this website.
Hope it helps.

http://www.bkjia.com/PHPjc/859710.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/859710.htmlTechArticleCommon vulnerabilities and code examples in PHP programming. PHP programming vulnerability examples are not impregnable. With the widespread use of PHP, Some hackers are also constantly looking for trouble with PHP, leaking information through PHP programs...