More details in /r/netsec:
http://www.reddit.com/r/netsec/comments/1sqppp/ebay_remoteco...
eBay remote code execution
11–17 of 17 posts
Re: eBay remote code execution
#12All I wanted to know was whether it was the new node.js code or the old old Java systems. I click through and get a PHP exploit? Letdown.
Learned something though.
Re: eBay remote code execution
#13Re: eBay remote code execution
#14A very interesting exploit.
This phrase "internally php strings are byte arrays. As a result accessing or modifying a string using array brackets will trick the parser into evaluating arbitrary php code in the scope of the variable if the prior mentioned requirements are met." doesn't seem to be present in the linked documentation (http://www.php.net/manual/en/language.types.string.php), however. Does anyone know what these "prior mentioned requirements" might be?
Re: eBay remote code execution
#15A very interesting exploit. This phrase "internally php strings are byte arrays. As a result accessing or modifying a string using array brackets will trick the parser into evaluating arbitrary php code in the scope of the variable if the prior mentioned requirements are met." doesn't seem to be present in the linked documentation ( http://www.php.net/manual/en/language.types.string.php ), however. Does anyone know w…
The actual quote from the manual, that they appear to be referencing, is:
Internally, PHP strings are byte arrays. As a result, accessing or modifying a string using array brackets is not multi-byte safe, and should only be done with strings that are in a single-byte encoding such as ISO-8859-1.
It seems like they just replaced:
is not multi-byte safe, and should only be done with strings that are in a single-byte encoding such as ISO-8859-1.
...with...
will trick the parser into evaluating arbitrary php code in the scope of the variable if the prior mentioned requirements are met.
Re: eBay remote code execution
#16Any links to other blogs/sites where the hacker talks through their thought process like this?
There are plenty of online databases which list exploits but I feel like you can learn a lot more from the process they used to come up with the exploit, as given here.
Re: eBay remote code execution
#17A very interesting exploit. This phrase "internally php strings are byte arrays. As a result accessing or modifying a string using array brackets will trick the parser into evaluating arbitrary php code in the scope of the variable if the prior mentioned requirements are met." doesn't seem to be present in the linked documentation ( http://www.php.net/manual/en/language.types.string.php ), however. Does anyone know w…
The actual quote from the manual, that they appear to be referencing, is: Internally, PHP strings are byte arrays. As a result, accessing or modifying a string using array brackets is not multi-byte safe, and should only be done with strings that are in a single-byte encoding such as ISO-8859-1. It seems like they just replaced: is not multi-byte safe, and should only be done with strings that are in a single-byte en…
But multi-byte safety is one thing, and executing arbitrary code is another.
It's still not an explanation of how you go from injecting a deformed string to executing code.