[meow]

Hi, in this tutorial I'll be teaching you different ways of circumventing Suhosin in PHP in order to get command execution.

First, what is Suhosin?
From their website, http://www.suhosin.org -

Spoiler:

Suhosin (pronounced 'su-ho-shin') is an advanced protection system for PHP installations. It was designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core. Suhosin comes in two independent parts, that can be used separately or in combination. The first part is a small patch against the PHP core, that implements a few low-level protections against buffer overflows or format string vulnerabilities and the second part is a powerful PHP extension that implements numerous other protections.

Onto the tutorial

This tutorial assumes that you have already shelled the server or found a way to shell it.

Lets start off with the command execution functions that Suhosin usually blocks -

Code:

system() exec() shell_exec() `` (backticks, same as shell_exec()) passthru() proc_open()

Some of them are different, but they all do at least one thing, execute commands on the server. However, we are unable to use those functions directly thanks to Suhosin disabling them.

But who said we had to play by the rules and use them directly? We can use some nice things called callback functions, and use the blocked functions indirectly. I'll be introducing one of them to you in this thread, and leave a list at the bottom so you can get creative yourself.

In this tutorial we're going to be using call_user_func() which is probably the easiest to use.

Code:

mixed call_user_func ( callable $callback [, mixed $parameter [, mixed $... ]] )

call_user_func() takes a callable callback as the first parameter (which will be our command execution function), and passes the remaining parameters as arguments in our callable callback function.

So how do we use this to circumvent Suhosin? It's really simple. We use one of the command execution functions as the first parameter and whatever command we want to execute as the second parameter. Here's what it would look like -

PHP Code:

call_user_func('system', 'id');

That would be the equivalent to running system('id');, the only difference is that the function is being passed through call_user_func() and therefor isn't being blocked by Suhosin. Obviously, you can replace "system" with any of the command execution functions mentioned earlier and it will work the same (unless you use proc_open, you'd have to change the parameters). Also, some command execution functions return output and others don't. If you test this and don't see any output, don't assume it doesn't work.

More callback functions

Here are some other callback functions you can play with to get command execution just in case the one above is blocked. Some require more little tweaks than others in order to work.

Code:

mixed call_user_func_array ( callable $callback , array $param_arr ) array array_map ( callable $callback , array $array1 [, array $... ] ) void register_shutdown_function ( callable $callback [, mixed $parameter [, mixed $... ]] )

End

If anyone has a suggestion for the thread or thinks I should add something I missed just post below.
@Megan first one, is it good?

[Oni]

Simple and to the point. I haven't seen as much of Suhosin as of late. Thanks for posting this.

[Nil]

Coming from someone with almost zero web knowledge, you made that easy to understand. Good job.

[Dyme]

Ehhhh this would have been a better tutorial if you wrote it 2-3 years ago. As far as I know this bug has been patched since php 5.5 (See here).

So yeah...

[Sans]

i heard you can ignore walls that you're working outside of.. but hey, that's a different subject, right?

[meow]

Ehhhh this would have been a better tutorial if you wrote it 2-3 years ago. As far as I know this bug has been patched since php 5.5 (See here).

So yeah...

Yeah you're right, it is. For the past couple of hours I've been trying to find a workaround using the same methodology in the thread to prove you wrong, but I wasn't able to.

I wonder if the create_function() + eval() method still works. Too lazy to test it since I just closed all of my connections and shit.

[Megan]

Great tutorial all the same though, can be handy for those running < 5.5 and it's still good for education.

[Sans]

hint 2: do you have to even look at a stop sign if you're going the other fucking way?

[Misha-]

You could use CGI if it's enabled, since suhosin doesn't work on Python scripts, for example.
If box is old enough, you could try Rora's shellshock bypass here
If "dl()" isn't disabled, you could also use that to load an extension of your own, which also bypasses suhosin if I remember correctly.
And as for last, you can try overwriting functions, but there are some requirements. Check it out here.
If you cant understand the post, use google translate. The code shouldn't be that hard to understand.

[meow]

You could use CGI if it's enabled, since suhosi... yada yada yada

Yes yes yes I know I know I know, this thread was just intended to be the callback func way of bypassing it (which doesn't work on newer versions of PHP ). I should've probably used a different thread title.