Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode?

As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it possible to bypass this modification? If i concatenate commands in the shell, i can bypass the forward slash:

[inserted by safe_mode '/'] command ; concatenated_command

this works in the shell, however, its not working when executed using proc_open in safe_mode (php 2.4.17).

Additionally, are there other techniques to bypass safe_mode in php 2.4.17?

thanks

share|improve this question
2  
You are aware that safe_mode is deprecated? PHP 2.4????!!! I'd be more worried about the bigger picture for PHP vulnerabilities. – symcbean Feb 7 '12 at 13:51

1 Answer

up vote 1 down vote

I don't know. However, if you control the application code, I would not recommend that you use proc_open() in your application if the attacker can control any aspect of the command, due to the risk of path traversal and command injecttion attacks. I can't tell exactly what your situation is, but based upon your question, it sounds like this may apply to you.

share|improve this answer
Thanks for your comment! You are definately right, in my opinion proc_open() is a security risk. However, i am evaluating how "safe" this function is, if safe_mode + open_baseDir (for preventing traversal attacks) really is. So far i have not succeeded in reading files outside my web basedir & launching a reverse shell connection using proc_open(). But im by any means no professional. I guess some real pentesters out there know alot more about this topic than me. – oliv Feb 7 '12 at 11:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.