[WebHacking] File Upload Vulnerability - Various Attacking Ways with LD_PRELOAD

In the last post, i introduced to you attacking with LD_PRELOAD environment variable and php MAIL function.

 

In this post, i'm gonna show you some other attacking ways in addition to MAIL function.

 

 

FIRST - Using other mail function except php MAIL function

PHP's various functions related with mail service

But except basic mail() function, we need to install those.

We can use mail() without any additional installation, but it requires 'sendmail' to use it in practice.

 

But to attack with IMAP functions, it must be installed on the server.

 

required option to use IMAP

After installation IMAP, the complie option on the above has to be set.

 

We can check phpinfo to find if it's available.

 

Configure Command in the phpinfo()

 

In the Configure Command of phpinfo, we can check things available.

 

IMAP is available in the test server, so i'll show you the example.

 

<?php
	imap_mail("a","a","a","a");
?>

 

I will make php file like the above and check it by using strace.

 

it executes execve("/bin/sh")

Same with mail() function, it executes execve("/bin/sh").

 

 

 

Second - Using error_log

 

error_log in PHP reference

 

one of the PHP functions, error_log, is function used to record error on the server.

 

But if we change "$message_type", we can send the error message by mail service.

 

message_type

examples of error_log

 

error_log([message], 1, [mail address])

If we use error_log like this, it tries to send it as a mail.

So we can guess it will work like mail() function.

 

Let's actually check it out using starce.

 

<?php
	error_log("test",1,"test@test.test");
?>

Good works

It executes 'execve'.

Therefore, we can attack using error_log too.

 

 

 

Third - Using ImageMagick

If we open PostScript type file(.pdf, .ps, .eps, ...),

 

to interpret this,

it executes ghostscript(like '/usr/bin/gs') by execve.

 

But nomally, for security reasons, those types are not availble in ImageMagick.

(Based on ImageMagick 3.4.3RC2)

 

But if invalid .eps file is opened by ImageMagick, we can bypass that security check

and execute execve("/usr/bin/gs").

 

This was used in [Google CTF 2019 - Wallbreaker Easy].

 

I recommend you to check the writeup about it uploaded on CTFTime.

 

 

 

Fourth - Another 'may be possible' ways

 

In the other ways, it may be possible to exploit, if we could induce it to use execve.

 

And, if there is a external function that some special PHP functions use,

we can overwrite that function to exploit, too.

 

I will update this post when i found some other ways.

 

Please let me know in the comments if there is anything wrong in the post or something to be added.

Thank you for reading.