disable_functions bypass - dl function
Important note:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2Fuser-images.githubusercontent.com%2F84577967%2F174675487-a4c4ca06-194f-4725-85af-231a2f35d56c.png&width=768&dpr=4&quality=100&sign=486a6573&sv=1)
dl
is a PHP function that can be used to load PHP extensions. It the function isn't disabled it could be abused to bypass disable_functions
and execute arbitrary commands.
However, it has some strict limitations:
The
dl
function must be present in the environment and not disabledThe PHP Extension must be compiled with the same major version (PHP API version) that the server is using (you can see this information in the output of phpinfo)
The PHP extension must be located in the directory that is defined by the
extension_dir
directive (you can see it in the output of phpinfo). It's very unprobeable that an attacker trying to abuse the server will have write access over this directory, so this requirement probably will prevent you to abuse this technique).
If you meet these requirements, continue reading the post https://antichat.com/threads/70763/ to learn how to bypass disable_functions. Here is a summary:
The dl function is used to load PHP extensions dynamically during script execution. PHP extensions, typically written in C/C++, enhance PHP's functionality. The attacker, upon noticing the dl
function is not disabled, decides to create a custom PHP extension to execute system commands.
Steps Taken by the Attacker:
PHP Version Identification:
The attacker determines the PHP version using a script (
<?php echo 'PHP Version is '.PHP_VERSION; ?>
).
PHP Source Acquisition:
Downloads the PHP source from the official PHP website or the archive if the version is older.
Local PHP Setup:
Extracts and installs the specific PHP version on their system.
Extension Creation:
Studies creating PHP extensions and inspects the PHP source code.
Focuses on duplicating the functionality of the exec function located at
ext/standard/exec.c
.
Notes for Compiling the Custom Extension:
ZEND_MODULE_API_NO:
The
ZEND_MODULE_API_NO
inbypass.c
must match the current Zend Extension Build, retrievable with:
PHP_FUNCTION Modification:
For recent PHP versions (5, 7, 8),
PHP_FUNCTION(bypass_exec)
may need adjustment. The provided code snippet details this modification.
Custom Extension Files:
bypass.c:
Implements the core functionality of the custom extension.
php_bypass.h:
Header file, defining extension properties.
config.m4:
Used by
phpize
to configure the build environment for the custom extension.
Building the Extension:
Compilation Commands:
Uses
phpize
,./configure
, andmake
to compile the extension.Resulting
bypass.so
is then located in the modules subdirectory.
Cleanup:
Runs
make clean
andphpize --clean
after compilation.
Uploading and Executing on the Victim Host:
Version Compatibility:
Ensures PHP API versions match between the attacker's and victim's systems.
Extension Loading:
Utilizes the
dl
function, circumventing restrictions by using relative paths or a script to automate the process.
Script Execution:
The attacker uploads
bypass.so
and a PHP script to the victim's server.The script uses
dl_local
function to dynamically loadbypass.so
and then callsbypass_exec
with a command passed via thecmd
query parameter.
Command Execution:
The attacker can now execute commands by accessing:
http://www.example.com/script.php?cmd=<command>
This detailed walkthrough outlines the process of creating and deploying a PHP extension to execute system commands, exploiting the dl
function, which should ideally be disabled to prevent such security breaches.
Last updated