Scope

PHP is rich and full-featured, with capabilities ranging from databases, to sockets, and file system manipulations. PHP can be used for scripting tasks in place of bash or other host-based scripting languages. We rarely use PHP this way during penetration testing because there are other languages that are more aligned with host-based scripting instead of the Web-based scripting where PHP shines, so this chapter is going to focus on the aspects of PHP which are Web-based. This is not to say that we won’t touch on file system manipulation or other areas that might be helpful for command-line scripting, but they will not be focused on as deeply and the context in which they will be discussed will be Web-based scenarios.

PHP basics

In order to run our PHP scripts, we will have to make sure our Web server is running. To do this, we start Apache on BackTrack 5 by issuing the command /etc/init.d/apache start. Next, we will change into the Web directory which is /var/lib/www. This directory is the root Web site for the Apache server, and the files we create will be accessible via our Web site at http://localhost.

Now that our site is configured, let’s build a simple PHP page. Base64 is an encoding method used frequently on the Internet to encode data for transmission. When we run across Base64-encoded data, the giveaway is a string of text that ends in one or more = signs. When we run across this type of data, the easiest way to decode it is to go to a script. For our first PHP page, let’s build one.

For our first Web page, we want to be able to accept input either through the URL or through a form. When we submit data, there are three ways we can access that data. The first is through either the $_GET or the $_POST array. These arrays contain, as we could probably guess, data submitted via GET and POST requests. The second is through the $_REQUEST array, which contains the values of the $_GET array, the $_POST array, and the $_COOKIE array. The third way requires a PHP setting called register_globals to be enabled in the PHP configuration file. In Version 5 of PHP, this is disabled by default as it is seen as less secure, which is why it is mentioned here. Register_globals forces any submitted data through either GET or POST requests to be assigned a variable. If we submitted a string where a=b, the $a variable would be set to b automatically. When building our own scripts, we want to discourage this behavior because we want the scripts to work on the Web server regardless of the configuration, so we code for compatibility instead of ease of use.

<?php

   if($_REQUEST[’b64’])

   {

     print "Base64 value for " . htmlspecialchars($_REQUEST[’b64’]) . " is <BR> <PRE>";

     print htmlspecialchars(base64_decode($_REQUEST[’b64’]));

     print " </PRE> <BR>";

   }

?>

</BR>

<FORM METHOD=POST>

   <TEXTAREA NAME=’b64’ COLS=80 ROWS=5>

   </TEXTAREA>

   <BR>

   <INPUT TYPE=SUBMIT VALUE="Submit!">

</FORM>

We begin by opening our PHP code block. There are two ways to open PHP code blocks in a Web page: with the <?php header or with the <? tag. The <? tag is referred to as a short open tag. It is a shorthand tag that was common in previous versions of PHP as it provided some shortcuts and led to shorter code. The problem is that if short tags are not enabled, the Web server will output all our PHP code to the Web page. Obviously, this is not desired, and, as having short tags enabled can cause problems with XML rendering, its default is now to be off. So, for all our code examples, we will use the <?php open tag.

Once our code block is open, we check to see if there is any input in our $_REQUEST array. We look specifically for the b64 variable that we want to decode. If it is there, we start by printing it back out to the screen with a print statement while encompassing our data in an htmlspecialchars function. This function escapes our HTML characters in order to ensure that we are not rendering any HTML tags which we shouldn’t be rendering. If we did not use this function, someone could send a request with HTML code in it and our page would try to render that.

Next, we print the output of the base64_decode function. This function decodes the Base64-encoded data and returns it as a string. We print that string, and then we close our PRE tag that we used to ensure that any formatting would be maintained.

Once the input is displayed, we want to create a simple form to allow submission of data. We do this by creating an HTML form block and indicating that it should be submitted via a POST method. Next, we create a textarea block and give it enough columns and rows to allow us to view encoded data as we paste it in. Finally, we create a submit button, and we’re done with our form. Figure 5.1 shows sample output from our script, which we will call b64.php.

Functions

In PHP, similarly to Python, Perl, Ruby, and the other languages we have covered, functions help us by reducing code reuse. PHP functions look very similar to other languages that we have worked with. To create a function, we use the function keyword followed by the name of the function we want to create. Let’s look at an example.

<?php

function printPre($data, $label = "")

{

   if($label != "")

   {

     print "<div align=center>$label</div><BR> ";

   }

   print "<PRE> ";

   print_r($data);

   print "</PRE> ";

}

printPre($_SERVER);

printPre($_ENV,"Environment Variables");

?>

When we’re debugging code, it’s nice to be able to easily print out debugging output. In previous examples, we’ve used PRE tags to print out arrays. Let’s convert this to a function. We want our function to take one argument, the thing we want to print. In addition, we may want to be able to easily apply a title. For our function, let’s make it require one argument, the data we want to print, and accept one additional argument, the title that we would like to be printed along with the data. To indicate that the second argument is optional, we set a default value for when it isn’t used. In our function, we check to see if the second argument is something other than empty; if it is, we print it, centered, as the title.

The first argument to our function is our data to print. We start by printing our PRE tags, and then do a print_r on the data to ensure that if the data is a data structure it is printed correctly. We follow by a close PRE tag, and our function is complete. In our code, we call our function in two ways: the first time without a title, and the second time with a title. Figure 5.4 shows part of our output with the title.

File handling

Knowledge of file handling in PHP gives us the ability to interact with the file system through a Web page, allowing us to take a Web vulnerability and leverage it to get higher levels of server access. There are three basic ways we access files. One is to include another PHP file in order to execute additional commands. The other two deal with either fetching or putting data into a file in the file system. Let’s investigate loading other PHP files first.

To begin, let’s create two files. In our first file, which we will call test.inc, we include the code <?php echo "hello world" ?>. In our second file, we will include that file in order to have it execute the PHP code. Into our second file, called test.php, we will insert the code <?php include(’test.inc’) ?>. Now let’s execute our test.php code. When we run test.php we should see our hello world statement. We have just executed code from another file in our file. There are four different ways to include files like this. They are include, require, include_once, and require_once. The include functions will try to include the other files, but if they fail they will return a warning. The require statements will stop execution if the file cannot be included. The two once variants are designed so that if we try to include a file that has already been included, the file won’t be included a second time, but the function will still return successfully.

Now that we know how to include other PHP files, let’s look at how to create a simple file downloader in PHP. There will be times when we want to generate some code that will allow us to pull data off a remote server. PHP can help us by sending headers to the browser to let it know it’s about to receive a file and prompt us to save the file. Let’s look at the code required to do this.

<?php

   if($_GET[’file’])

   {

     $file = $_GET[’file’];

     if(file_exists($file) && is_file($file))

     {

       $basename = basename($file);

       header("Content-disposition: attachment; filename=$basename");

       readfile($file);

     }

   }

?>

We begin our code by looking in the _GET array at the value for the file key. That should contain a filename if we passed it in correctly to our script. If the value exists, we then set the $file variable equal to the file path that was passed in. We do another conditional to confirm that the file exists and that it is a file; otherwise, the script will fail. If the checks pass, we begin by determining the last part of the filename. The basename function does this by stripping everything that is path-related off the string that we passed in. This gives us just the filename itself. We use this in our header, as we tell PHP to return to the browser a content-disposition header indicating that we are going to be sending a file attachment and the filename should be the filename itself, without the path information. Once we have all this set up, the browser will take everything else and interpret it as the file contents. We use the readfile function to grab the entire contents of the file and print it out. Let’s test this out with the URL http://localhost/download.php?file=/etc/passwd and examine the output in Figure 5.7.

We’ve dealt with files in two different ways so far, so let’s look at the third way. PHP can also read and write to files in a more conventional way. We have used file open commands in other languages, such as Ruby and Python, and PHP has a command that is very similar to the commands we’ve seen before. The fopen function allows us to open a file for reading, writing, or appending, just like the other languages. To explore this, let’s look at a script that will allow us to read or write data, depending on the get line.

<?php

if($_GET[’read’])

{

   $file = $_GET[’read’];

   if(file_exists($file) and is_file($file))

   {

     $f = fopen($file,"r");

     print "<PRE>File contents are: ";

     $out = "";

     while($data = fread($f,1024))

     {

       $out .= $data;

     }

     fclose($f);

     print $out;

   }

}

We segment our code into two sections. If the read GET variable is set, we set the $file variable to the value of the read key in the $_GET array. If the file exists, we open the file for reading with the fopen function. We specify that the file is read by setting the mode to r, just as we have in Perl and Python. The fopen function returns a file handle which we set to $f. The file handle is what we will use to reference this file from now on. We initialize an $out variable, which will be used to store our output. To read the whole file in, we create a while loop that will read data from our file, up to 1,024 characters at a time. After each iteration, we append the data we read to our out variable using the concatenation operator, .=, which sets $out to the value of $out plus $data. Once we run out of data, the loop stops. We close our file and print the output to the screen.

if($_GET[’write’] && $_GET[’data’])

{

  $file = $_GET[’write’];

  $data = $_GET[’data’];

  $f = fopen($file,"a+");

  fwrite($f,$data . " ");

  fclose($f);

  print "Write to $file: <BR><PRE>$data</PRE>";

}

?>

For writing data, we need to check for both our filename, and data to write. We build a conditional that checks for the write key and the data key set in our $_GET array. If both keys are set, we set $file to our filename and $data to the data we want to write to the file. Next, we open the file in append mode by specifying a+ as the mode. Our fopen function returns a file handle, and we use that handle for our fwrite function. Fwrite takes two options, the file handle and the data to write. After we write our data, we close the file handle and print a success message to the screen. To test this script, let’s call it readwrite.php, and test it with a URL of http://localhost/readwrite.php?read=/etc/passwd&write=/tmp/test&data=This is a test, and we should see output similar to Figure 5.8.

Command execution

Command execution is an important concept within PHP because when we find vulnerabilities in PHP applications, being able to execute arbitrary code on the server will help us further our access to the machine. There are three basic ways to execute commands on the operating system in PHP: the passthru, exec, and system functions. Passthru will allow us to print the output of our executed code to the screen, while the other two will return data in different ways. Let’s look at passthru first, in an example we may see in the real world: some scripts executing code to facilitate sys-admin tasks. Let’s take a script that will list out extended attributes of a file that is passed into it.

<?php

print "<PRE>";

$file = $_GET[’file’];

passthru("ls −l $file");

print "</PRE>";

?>

Our code takes the file variable passed in from the get line, and then executes an ls −l on the output. The output from the passthru command is printed directly to the screen. We wrap the output in PRE tags so that it will appear normal. Let’s start by using the script as it is intended: Save the script as systest.php and go to http://localhost/systest.php?file=beef. We can see that the output is the directory listing from the beef subdirectory. Now, let’s look at how we abuse a script like this. Remember all the shell commands that we looked at in Chapter 1? Let’s put those to use. Go to http://localhost/systest.php?file=.;cat /etc/passwd. In Figure 5.9, we can now see how we have included the directory listing of the . directory, but by using the semicolon we have chained an additional command, and we can also see the contents of /etc/passwd.

The system command works similarly to passthru, in that it will print the output to the screen. The primary difference is that it also returns some data to us. The system function returns the last line from the output, so if we need to know what the last line is, we can perform additional operations on it. While this is sometimes useful, it is more likely that if we want to process the output from a command, we will use the exec function. The exec function takes two arguments, the command to run and a variable in which to store the results. The results will be put into the result variable as an array. By default, nothing from an exec function is printed to the screen. Let’s look at an example using both types.

<?php

print "<PRE>";

exec("ls -l",$out);

print_r($out);

print "-------------------------------- ";

$last = system("ls -l");

print "</PRE>";

?>

Our exec command is being used with two arguments. The first argument, ls −l, is our command, and the second variable is $out, which will be our array of output. When we look at the output in Figure 5.10 we can see that when we print the contents of $out using print_r, each line of our output is a different element of the array. This will allow us to manipulate the output through the array if we wanted to do any post-processing. Next, we print a separator line and use the system command. We will capture the last line of output in the $last variable, although we won’t print it to the screen. We’ll use system to do another ls −l, and when we look at Figure 5.10, we will see that the output prints to the screen directly.

We have now investigated three different ways to execute commands in PHP. We can use these to help build more complex scripts, such as a PHP shell.