Exploitable PHP functions

Answer 1

Let's add pcntl_signal and pcntl_alarm to the list.

With the help of those functions you can work around any set_time_limit restriction created int the php.ini or in the script.

This script for example will run for 10 seconds despite of set_time_limit(1);

(Credit goes to Sebastian Bergmanns tweet and gist:

<?php
declare(ticks = 1);

set_time_limit(1);

function foo() {
    for (;;) {}
}

class Invoker_TimeoutException extends RuntimeException {}

class Invoker
{
    public function invoke($callable, $timeout)
    {
        pcntl_signal(SIGALRM, function() { throw new Invoker_TimeoutException; }, TRUE);
        pcntl_alarm($timeout);
        call_user_func($callable);
    }
}

try {
    $invoker = new Invoker;
    $invoker->invoke('foo', 1);
} catch (Exception $e) {
    sleep(10);
    echo "Still running despite of the timelimit";
}

Answer 2

Several buffer overflows were discovered using 4bit characters functions that interpret text. htmlentities() htmlspecialchars()

were at the top, a good defence is to use mb_convert_encoding() to convert to single encoding prior to interpretation.

Answer 3

This is not an answer per se, but here's something interesting:

$y = str_replace('z', 'e', 'zxzc');
$y("malicious code");

In the same spirit, call_user_func_array() can be used to execute obfuscated functions.

Answer 4

One source of interesting exploits has not been mentioned. PHP allows strings to have 0x00 bytes in them. Underlying (libc) functions treat this as the end of a string.

This allows for situations where (poorly implemented) sanity-checking in PHP can be fooled, e.g. in a situation like:

/// note: proof of principle code, don't use
$include = $_GET['file'];
if ( preg_match("/\\.php$/",$include) ) include($include);

This might include any file - not just those ending in .php - by calling script.php?file=somefile%00.php

So any function that will not obey PHP's string length may lead to some vulnerability.

Answer 5

Here is a list of functions my provider disables for security purposes:

• exec
• dl
• show_source
• apache_note
• apache_setenv
• closelog
• debugger_off
• debugger_on
• define_syslog_variables
• escapeshellarg
• escapeshellcmd
• ini_restore
• openlog
• passthru
• pclose
• pcntl_exec
• popen
• proc_close
• proc_get_status
• proc_nice
• proc_open
• proc_terminate
• shell_exec
• syslog
• system
• url_exec