Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 7 May 2017 12:12:59 -0400
From: Kash Pande <kash@...pleback.net>
To: oss-security@...ts.openwall.com
Subject: Re: [white-paper] Pwning PHP mail() function For Fun
 And RCE (ver 1.0)


On 03/05/17 04:32 PM, Dawid Golunski wrote:
> Here's a paper I wrote back in December.  It was originally meant to go
> into Phrack but the team wanted a more general article on parameter injection
> as mail() was supposedly an outdated technique.
> Meanwhile, the RCE-chain continues :) So I decided to post it as it is without
> changing it as mail() injection deserves a separate article imho.
>
> https://exploitbox.io/paper/Pwning-PHP-Mail-Function-For-Fun-And-RCE.html

This article purposely uses a litany of poor programming practices to 
expose an alleged exploit in PHP mail().. I'd like to see the same 
exploit, without assuming the developer on the software had no idea what 
they're doing (passing non-sanitized variables to functions). As well, 
you noted in your own article that this 'discovery' was first published 
in 2011 by someone else.

>
> I reveal some exim code-execution vectors in there that should change
> the whole game slightly :)

Not really, because it still relies on unfiltered input.



Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ