PHP-5.3.9远程执行任意代码漏洞(CVE-2012-0830) 详解

while (1) {

     if (zend_symtable_find(symtable1, escaped_index, index_len + 1, (void **) &gpc_element_p) == FAILURE

          || Z_TYPE_PP(gpc_element_p) != IS_ARRAY) { //(3)

          if (zend_hash_num_elements(symtable1) <= PG(max_input_vars)) { // (4)

               if (zend_hash_num_elements(symtable1) == PG(max_input_vars)) {

                    php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variables exceeded %ld. ...", PG(max_input_vars)); // (1)

               }

               MAKE_STD_ZVAL(gpc_element);

               array_init(gpc_element);

               zend_symtable_update(symtable1, escaped_index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);

          }

          //......

     }

     //.....

     symtable1 = Z_ARRVAL_PP(gpc_element_p); // (2)

     goto plain;

}< li>

struct _zval_struct {

    /* Variable information */

    zvalue_value value; /* value */

    zend_uint refcount__gc;

    zend_uchar type; /* active type */

    zend_uchar is_ref__gc;

};< li>

typedef union _zvalue_value {

    long lval; /* long value */

    double dval; /* double value */

    struct {

        char *val;

        int len;

    } str;

    HashTable *ht; /* hash table value */

    zend_object_value obj;

} zvalue_value;< li>

typedef struct _hashtable {

    uint nTableSize;

    uint nTableMask;

    uint nNumOfElements;

    ulong nNextFreeElement;

    Bucket *pInternalPointer; /* Used for element traversal */

    Bucket *pListHead;

    Bucket *pListTail;

    Bucket **arBuckets;

    dtor_func_t pDestructor; //注意这个

    zend_bool persistent;

    unsigned char nApplyCount;

    zend_bool bApplyProtection;

#if ZEND_DEBUG

    int inconsistent;

#endif

} HashTable;< li>

<?php
function encode_file_contents($filename) {
$type=strtolower(substr(strrchr($filename,'.'),1));
if('php'==$type && is_file($filename) && is_writable($filename)){// 如果是PHP文件 并且可写 则进行压缩编码
$contents = file_get_contents($filename);// 判断文件是否已经被编码处理
$contents = php_strip_whitespace($filename);
// 去除PHP头部和尾部标识
$headerPos = strpos($contents,'<?php');
$footerPos = strrpos($contents,'?>');
$contents = substr($contents,$headerPos+5,$footerPos-$headerPos);
$encode = base64_encode(gzdeflate($contents));// 开始编码
$encode = '<?php'."n eval(gzinflate(base64_decode("."'".$encode."'".")));nn?>";
return file_put_contents($filename,$encode);

}
return false;
}
//调用函数
$filename='dam.php';
encode_file_contents($filename);
echo "OK,加密完成！"
?>

<?php
function RandAbc($length=""){//返回随机字符串
  $str="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
  return str_shuffle($str);
}
$filename='dam.php';
$T_k1=RandAbc();//随机密匙1
$T_k2=RandAbc();//随机密匙2
$vstr=file_get_contents($filename);//要加密的文件
$v1=base64_encode($vstr);
$c=strtr($v1,$T_k1,$T_k2);//根据密匙替换对应字符。
$c=$T_k1.$T_k2.$c;
$q1="O00O0O";
$q2="O0O000";
$q3="O0OO00";
$q4="OO0O00";
$q5="OO0000";
$q6="O00OO0";
$s='$'.$q6.'=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$'.$q1.'=$'.$q6.'{3}.$'.$q6.'{6}.$'.$q6.'{33}.$'.$q6.'{30};$'.$q3.'=$'.$q6.'{33}.$'.$q6.'{10}.$'.$q6.'{24}.$'.$q6.'{10}.$'.$q6.'{24};$'.$q4.'=$'.$q3.'{0}.$'.$q6.'{18}.$'.$q6.'{3}.$'.$q3.'{0}.$'.$q3.'{1}.$'.$q6.'{24};$'.$q5.'=$'.$q6.'{7}.$'.$q6.'{13};$'.$q1.'.=$'.$q6.'{22}.$'.$q6.'{36}.$'.$q6.'{29}.$'.$q6.'{26}.$'.$q6.'{30}.$'.$q6.'{32}.$'.$q6.'{35}.$'.$q6.'{26}.$'.$q6.'{30};eval($'.$q1.'("'.base64_encode('$'.$q2.'="'.$c.'";eval('?>'.$'.$q1.'($'.$q3.'($'.$q4.'($'.$q2.',$'.$q5.'*2),$'.$q4.'($'.$q2.',$'.$q5.',$'.$q5.'),$'.$q4.'($'.$q2.',0,$'.$q5.'))));').'"));';
$s='<?php
'.$s.
'
 ?>';
echo "OK,加密完成！";
//生成 加密后的PHP文件
$fpp1 = fopen('dam.php','w');
fwrite($fpp1,$s) or die('写文件错误');
?>

function num_check($id) {
if (! $id) {
die ( '参数不能为空！' );
} //是否为空的判断
else if (inject_check ( $id )) {
die ( '非法参数' );
} //注入判断
else if (! is_numetic ( $id )) {
die ( '非法参数' );
}
//数字判断
$id = intval ( $id );
//整型化
return $id;
}

//字符过滤函数
function str_check($str) {
if (inject_check ( $str )) {
die ( '非法参数' );
}
//注入判断
$str = htmlspecialchars ( $str );
//转换html
return $str;
}
function search_check($str) {
$str = str_replace ( "_", "_", $str );
//把"_"过滤掉
$str = str_replace ( "%", "%", $str );
//把"%"过滤掉
$str = htmlspecialchars ( $str );
//转换html
return $str;
}
//表单过滤函数
function post_check($str, $min, $max) {
if (isset ( $min ) && strlen ( $str ) < $min) {
die ( '最少$min字节' );
} else if (isset ( $max ) && strlen ( $str ) > $max) {
die ( '最多$max字节' );
}
return stripslashes_array ( $str );
}

//防注入函数
function inject_check($sql_str) {
return eregi ( 'select|inert|update|delete|'|/*|*|../|./|UNION|into|load_file|outfile', $sql_str );
// www.111cn.net 进行过滤，防注入
}

function stripslashes_array(&$array) {
if (is_array ( $array )) {
foreach ( $array as $k => $v ) {
$array [$k] = stripslashes_array ( $v );
}
} else if (is_string ( $array )) {
$array = stripslashes ( $array );
}
return $array;
}

<?

$q = "SELECT `id` FROM `users` WHERE `username`= ' " .$_GET['username']. " ' AND `password`= ' " .$_GET['password']. " ' ";

?>

' ; SHOW TABLES;

'; DROP TABLE [table name];

INSERT INTO tbl_user SET uid="1";
SELECT * FROM tbl_user WHERE uid="1";

INSERT INTO tbl_user SET uid=1;
SELECT * FROM tbl_user WHERE uid=1;

<?
if ( isset($_POST["f_login"] ) )
{
  // 连接数据库...
  // ...代码略...
 
  // 检查用户是否存在
  $t_strUid = $_POST["f_uid"];
  $t_strPwd = $_POST["f_pwd"];
  $t_strSQL = "SELECT * FROM tbl_users WHERE uid=$t_strUid AND password = '$t_strPwd' LIMIT 0,1";
  if ( $t_hRes = mysql_query($t_strSQL) )
  {
    // 成功查询之后的处理. 略...
  }

}
?>
<html><head><title>sample test</title></head>
<body>
<form method=post action="">
  User ID: <input type="text" name="f_uid" size=30><br>

  Password: <input type=text name="f_pwd" size=30><br>
  <input type="submit" name="f_login" value="登录">
</form>
</body>

<?

$q = "SELECT `id` FROM `users` WHERE `username`= ' " .mysql_real_escape_string( $_GET['username'] ). " ' AND `password`= ' " .mysql_real_escape_string( $_GET['password'] ). " ' ";

?>

<?

//connection
$database = mysql_connect("localhost", "username","password");

//db selection
mysql_select_db("database", $database);

$q = mysql_query("SELECT `id` FROM `users` WHERE `username`= ' " .mysql_real_escape_string( $_GET['username'] ). " ' AND `password`= ' " .mysql_real_escape_string( $_GET['password'] ). " ' ", $database); 

?>