return FAILURE;

}

php_error_docref(NULL TSRMLS_CC, E_WARNING, "Mail option not available!");

return FAILURE;

}

break;

case 2: /*send to an address */

php_error_docref(NULL TSRMLS_CC, E_WARNING, "TCP/IP option not available!");

return FAILURE;

break;

case 3: /*save to a file */

stream = php_stream_open_wrapper(opt, "a", IGNORE_URL | ENFORCE_SAFE_MODE | REPORT_ERRORS, NULL);

if (!stream)

return FAILURE;

php_stream_write(stream, message, strlen(message));

php_stream_close(stream);

break;

default:

php_log_err(message TSRMLS_CC);

break;

}

return SUCCESS;

}
可以看到error_log函数的核心就是 php_stream_open_wrapper()函数,问题也就出在保存错误信息的文件这一步,看下这个函数的语法:
php_stream * php_stream_open_wrapper ( char * path, char * mode, int options, char ** opened )
php_stream_open_wrapper() opens a stream on the file, URL or other wrapped resource specified by path.
r
Open text file for reading. The stream is positioned at the beginning of the file.
r+
Open text file for reading and writing. The stream is positioned at the beginning of the file.
w
Truncate the file to zero length or create text file for writing. The stream is positioned at the beginning of the file.
w+
Open text file for reading and writing. The file is created if it does not exist, otherwise it is truncated. The stream is positioned at the beginning of the file.
a
Open for writing. The file is created if it does not exist. The stream is positioned at the end of the file.
a+
Open text file for reading and writing. The file is created if it does not exist. The stream is positioned at the end of the file.
error_log函数里定义了a选项,就是检查当保存错误信息文件不存在时创建一个,到这都没问题,关键是后面:
IGNORE_URL | ENFORCE_SAFE_MODE | REPORT_ERRORS
如果定义了一个IGNORE_URL那么将关闭后面的SAFE_MODE 开关,这样如果把错误信息写成代码,后面加上如prefix://../../的URL,则代码被写入到一个PHP文件时就已经绕过了SAFE_MODE 的限制,再访问保存错误信息的文件则代码被顺利无限制的执行了.
归根结底漏洞产生于php_stream_open_wrapper()函数,然后被嵌套调用了.
还有一个以前的的copy函数bypass漏洞
 $temp=tempnam( $tymczas, "cx");
if(copy("compress.zlib://". $file,  $temp)){
 $handle = fopen( $temp, "r");
 $tekst = fread( $handle, filesize( $temp));
fclose( $handle);
通过这样一段利用代码再指定一个 $file就可以绕过安全模式读取任何文件了
漏洞的存在都是互相映射的,应用层的漏洞在底层也会出现,就象上面这些逻辑类的,那应用层最容易疏忽的过滤不严的漏洞在底层会出现吗?当然!看看tempnam()函数中的一段核心代码:
if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &arg1, &arg2) ==
FAILURE) {
  WRONG_PARAM_COUNT;
}
convert_to_string_ex(arg1);
convert_to_string_ex(arg2);
if (php_check_open_basedir(Z_STRVAL_PP(arg1) TSRMLS_CC)) {
  RETURN_FALSE;
}

d = estrndup(Z_STRVAL_PP(arg1), Z_STRLEN_PP(arg1));
strlcpy(p, Z_STRVAL_PP(arg2), sizeof(p));

开始的函数原型给出了，第1个参数是指定生成临时文件的目录，第2个参数是生成临时文件的前缀.开始是对两个参数类型的检查及定义，然后对参数做限制，问题就出在红色代码处这个函数：php_check_open_basedir()是用来检查参数完整性并检查接受到的目录参数是否在open-basedir内，也就是按说我们对tempnam()传递参数后是不能在这个参数之外的目录生成临时文件了，可是居然函数只限制了arg1，没有过滤arg2，这样一来前面的限制就不会起作用了，然后后面就把arg2的参数附加给arg1了.接着就导致可以绕过openbase_dir的限制写文件了.

应了那句老话,任何地方都没有绝对的安全.在应用层安全系数越来越高的时候,关注底层,利用底层的一些缺陷可以更有利于做WEB应用层的漏洞挖掘.

另外PHP的安全也体现在做一些安全方面的工作,这点得益与PHP强大的功能,比如用做协议解析
<?
function hex2dec( $hex)
{
 $v=Ord( $hex);
if(47< $v&& $v<58)
return  $v-48;
if(64< $v&& $v<71)
return  $v-65+10;
if(96< $v&& $v<103)
return  $v-97+10;
}
function hex2str( $str)
{
if(! $str)
return false;
 $code="";
for( $i=0; $i<strlen( $str); $i+=2)
{
 $code.=chr(hex2dec(substr( $str, $i,1))*16+hex2dec(substr( $str, $i+1,1)));
}
return  $code;
}
if (empty( $_POST['str'])) {
echo"/*n";
echo "Please input Hex string!";
echo"n";
echo"*/n";
}else{
 $str= $_POST['str'];
 $result=hex2str( $str);
echo "Decoder:";
echo"n";
echo htmlspecialchars(stripslashes( $result));
 $newresult=str_replace(" ","0x20", $result);
 $a=explode('0x20',  $newresult, 3);
echo "***************************************************";
echo"n";
echo "Method:";
echo htmlspecialchars(stripslashes( $a[0]));
echo"nn";
echo "URL:";
echo htmlspecialchars(stripslashes( $a[1]));
echo"nn";
echo htmlspecialchars(stripslashes( $a[2]));
echo "***************************************************";
}
?>
提交sniffer到的16进制数据like this:
504F5354202F6566696374696F6E2F76696577757365722E7068703F7569643D27554E494F4E25323053454C454354253230302C302C302C302C302C302C302C302C302C302C70617373776F72642C302C302C302C3025323046524F4D25323066616E66696374696F6E5F617574686F72732532302F2A7320485454502F312E300D0A0D0A
转换后likethis:
***************************************************
Method:POST

URL:/efiction/viewuser.php?uid='UNION%20SELECT%200,0,0,0,0,0,0,0,0,0,password,0,0,0,0%20FROM%20fanfiction_authors%20/*s

HTTP/1.0

代码很简单,可功能很实用,如果需要可以写端口扫描,fuzzer,甚至google hacking工具等,只要你能想到:)