Awesome
PHP Hardening Phuzzer
It uses feedback from xdebug and strace to generate random and arbitrary input parameters to a PHP script and find code paths which lead to exploitation. Primarily it's designed to scan for vulnerabilities in PHP scripts which are web accessible but not meant to be run directly.
Features
- Detect input parameters, _GET, _POST, _REQUEST, _COOKIE and _FILES
- Generate random input parameters
- Find unique code paths
- systemcall tracing with strace and dtruss, tested on Linux & OSX
- PHP function call tracing, using Xdebug
TODO
- Make it suck less
- Analysis of collected Phuzz cases/traces, automatic exploit generation
- dtrace and systemtap support
Example
The first request is made to analyse which inputs the script uses.
[Thu Sep 8 17:36:00 2016] 127.0.0.1:36996 [200]: /rce1.php
It then generates random values for the required parameters, and finds all the PHP and system calls that.
[Thu Sep 8 17:36:00 2016] 127.0.0.1:36998 [200]: /rce1.php?cmd=SWGAGI55
<webroot>/rce1.php
system ( 'SWGAGI55' )
syscalls:
stat ( "/usr/local/sbin/SWGAGI55", 0x7ffff9f76140 )
stat ( "/usr/local/bin/SWGAGI55", 0x7ffff9f76140 )
stat ( "/usr/sbin/SWGAGI55", 0x7ffff9f76140 )
stat ( "/usr/bin/SWGAGI55", 0x7ffff9f76140 )
stat ( "/sbin/SWGAGI55", 0x7ffff9f76140 )
stat ( "/bin/SWGAGI55", 0x7ffff9f76140 )
stat ( "/usr/games/SWGAGI55", 0x7ffff9f76140 )
stat ( "/usr/local/games/SWGAGI55", 0x7ffff9f76140 )
Installation
Debian / Ubuntu
sudo apt-get install php5.6-cli php-xdebug
pip install -r requirements.txt
sudo sh -c 'echo 0 > /proc/sys/kernel/yama/ptrace_scope' python -mphuzz
OSX
brew install php56 php56-xdebug
pip install -r requirements.txt
python -mphuzz
Microsoft Windows (XP or above)
- Click on
Start
button (bottom left hand corner of screen) - Click
My Computer
- Navigate to
C:\Program Files (Intel X86 Architecture)\Microsoft Internet Explorer Professional Edition 2016\
- Locate
iexplore.exe
, you may have to use the scroll bars - Click on it... twice, quickly!
- Wait until new window opens up
- Find the white bar with
http://worldwideweb.msn.com/en-US/infestedmalwaresmegma.exe
in it - Click the text, just once!
- Press the
Ctrl
andA
buttons on your keyboard, together, at the same time. - Type in
www.google.com
- Wait until your computer starts responding again
- Type in
Self immolation techniques for beginners
- Press the
Search
button - Follow instructions until warm throughout
TL;DR any ideas on porting this to Win32 API?