5

Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode?

As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it possible to bypass this modification? If i concatenate commands in the shell, i can bypass the forward slash:

[inserted by safe_mode '/'] command ; concatenated_command

this works in the shell, however, its not working when executed using proc_open in safe_mode (php 2.4.17).

Additionally, are there other techniques to bypass safe_mode in php 2.4.17?

thanks

1
  • 2
    You are aware that safe_mode is deprecated? PHP 2.4????!!! I'd be more worried about the bigger picture for PHP vulnerabilities.
    – symcbean
    Feb 7, 2012 at 13:51

1 Answer 1

1

I don't know. However, if you control the application code, I would not recommend that you use proc_open() in your application if the attacker can control any aspect of the command, due to the risk of path traversal and command injecttion attacks. I can't tell exactly what your situation is, but based upon your question, it sounds like this may apply to you.

1
  • Thanks for your comment! You are definately right, in my opinion proc_open() is a security risk. However, i am evaluating how "safe" this function is, if safe_mode + open_baseDir (for preventing traversal attacks) really is. So far i have not succeeded in reading files outside my web basedir & launching a reverse shell connection using proc_open(). But im by any means no professional. I guess some real pentesters out there know alot more about this topic than me.
    – oliv
    Feb 7, 2012 at 11:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .