Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode?

As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it possible to bypass this modification? If i concatenate commands in the shell, i can bypass the forward slash:

[inserted by safe_mode '/'] command ; concatenated_command

this works in the shell, however, its not working when executed using proc_open in safe_mode (php 2.4.17).

Additionally, are there other techniques to bypass safe_mode in php 2.4.17?


  • 2
    You are aware that safe_mode is deprecated? PHP 2.4????!!! I'd be more worried about the bigger picture for PHP vulnerabilities.
    – symcbean
    Feb 7 '12 at 13:51

I don't know. However, if you control the application code, I would not recommend that you use proc_open() in your application if the attacker can control any aspect of the command, due to the risk of path traversal and command injecttion attacks. I can't tell exactly what your situation is, but based upon your question, it sounds like this may apply to you.

  • Thanks for your comment! You are definately right, in my opinion proc_open() is a security risk. However, i am evaluating how "safe" this function is, if safe_mode + open_baseDir (for preventing traversal attacks) really is. So far i have not succeeded in reading files outside my web basedir & launching a reverse shell connection using proc_open(). But im by any means no professional. I guess some real pentesters out there know alot more about this topic than me.
    – oliv
    Feb 7 '12 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.