4 ms·
The root of this issue seems to be a regexp function (preg_match()) in PHP coupled with an exec() of a variable that was not properly screened, coupled with an
by peter_d_sherman 7y ago
The root of this issue seems to be a regexp function (preg_match()) in PHP coupled with an exec() of a variable that was not properly screened, coupled with an 'sudo' inside of the exec(), e.g.:
exec("sudo pihole -a addstaticdhcp ".$mac." ".$ip." ".$hostname);
and/or
exec("sudo pihole -a removestaticdhcp ".$mac);
So three places to audit:
1) Regexp's and related complex high-level functions;
2) Calls to exec()
3) Uses of sudo within an exec()
- kpcyrd 7y agoThe problem is that php expects a string that is then passed to sh -c, which is then parsed by a shell. Instead php should have an interface that accepts: exec(["sudo", "pihole", "-a", "addstaticdhcp", $mac, $ip, $hostname]); without any shell trickery. If there's a sudo in this specific like doesn't matter, your reverse shell is going to run as a regular user and after that it only matters low locked down the sudoers configuration is.
- kilburn 7y agoDefinitely not ideal, but php provides the escapeshellarg [1] function you are supposed to use in these situations. You can even implement a "safe" exec function like so: function safe_exec(array $args, array &$output = null, int &$return_var = 0) : string { return exec( implode(' ', array_map('escapeshellarg', $args) ), $output, $return_var ); } // Example usage $output = []; $return_var = 0; echo safe_exec(['ls', '/tmp'], $output, $return_var); var_export($output); echo "Exit code: $return_var\n"; [1] https://www.php.net/manual/en/function.escapeshellarg.php https://www.php.net/manual/en/function.escapeshellarg.php