How PHP extension Taint finds potential security vulnerabilities in websites (must read)

The content of this article is about how the PHP extension Taint can find potential security vulnerabilities in the website. It has certain reference value. Friends in need can refer to it. I hope it will be helpful to you.

1. Background

The author has been interested in network security since he came into contact with computers. I am doing PHP After the development, I have been paying close attention to WEB security. In 2016, I accidentally discovered the Taint extension. After experiencing it, I found that it is really useful. However, when I checked the relevant information at that time, I found that not many people paid attention to this extension. Recently, because I changed my computer, I need After installing this extension again, I found that there are still relatively few people using this extension, so I recorded the installation process and test results to facilitate subsequent use and also allow more developers to understand taint

2. Operation overview

1. Source code download and compilation

2. Extended configuration and installation

3. Functional Inspection and Testing

3. Source code download and compilation

The Taint extension PHP itself does not carry, in the linux or mac system the author You need to download the source code to compile and install it yourself

3.1 Source code download

The author’s development environment is a mac system, so I need to go to PHP’s pecl extension website to download the source code, in which taint The address is:

https://pecl.php.net/package/taint

At the end of the extension URL, you can see a row of download addresses, as shown below

The author You need to choose a suitable version. The author's development environment uses PHP7.1, so I chose the latest version. The corresponding download address is as follows:

https://pecl.php.net/get/taint-2.0.4.tgz

Use wget to download the source code. The reference command is as follows:

wget https://pecl.php.net/get/taint-2.0.4.tgz

After downloading, I need to unzip it. The decompression command reference is as follows:

tar -zxvf taint-2.0.4.tgz

After decompression, enter the directory. The reference command is as follows:

cd taint-2.0.4

3.2 Source code compilation

Now I need to compile the source code. Before compiling, I can use phpze to detect the PHP environment. The reference command is as follows:

phpize

The return result is as follows

Configuring for:
PHP Api Version:         20160303
Zend Module Api No:      20160303
Zend Extension Api No:   320160303

Generate Makefile, Prepare for the next step of compilation

./configure

Return results

checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... no

creating libtool
appending configuration tag "CXX" to libtool
configure: creating ./config.status
config.status: creating config.h

Start compilation and install

make && make install

(cd .libs && rm -f taint.la && ln -s ../taint.la taint.la)
/bin/sh /Users/song/taint-2.0.4/libtool --mode=install cp ./taint.la /Users/song/taint-2.0.4/modules
cp ./.libs/taint.so /Users/song/taint-2.0.4/modules/taint.so
cp ./.libs/taint.lai /Users/song/taint-2.0.4/modules/taint.la
----------------------------------------------------------------------
Libraries have been installed in:
   /Users/song/taint-2.0.4/modules

If you ever happen to want to link against installed libraries
in a given directory, LIBDIR, you must either use libtool, and
specify the full pathname of the library, or use the `-LLIBDIR'
flag during linking and do at least one of the following:
   - add LIBDIR to the `DYLD_LIBRARY_PATH' environment variable
     during execution

See any operating system documentation about shared libraries for
more information, such as the ld(1) and ld.so(8) manual pages.
----------------------------------------------------------------------

Build complete.
Don't forget to run 'make test'.

Installing shared extensions:     /usr/local/Cellar/php71/7.1.14_25/lib/php/extensions/no-debug-non-zts-20160303/

4. Configuration and installation

After compiling the extension, the author also needs to put Taint in the specified location and modify the configuration file to make it effective

4.1 Configure taint

The author first needs to know PHP What is the configuration file? Then by checking the extension path of the configuration file, you can put the so file into the corresponding one. The command to check the configuration file location is as follows:

php --ini

The return result is as follows

Configuration File (php.ini) Path: /usr/local/etc/php/7.1
Loaded Configuration File:         /usr/local/etc/php/7.1/php.ini
Scan for additional .ini files in: /usr/local/etc/php/7.1/conf.d
Additional .ini files parsed:      /usr/local/etc/php/7.1/conf.d/ext-opcache.ini

The author You can see that php.ini is placed in /usr/local/etc/php/7.1/php.ini

After knowing the configuration file, the author needs to find the location of the extension folder, refer to the command The following

cat /usr/local/etc/php/7.1/php.ini | grep extension_dir

command execution results are as follows. The author can see that the location of the extension folder is /usr/local/lib/php/pecl/20160303

extension_dir = "/usr/local/lib/php/pecl/20160303"
; extension_dir = "ext"
; Be sure to appropriately set the extension_dir directive.
;sqlite3.extension_dir =

4.2 Install the extension

Now I need to copy the extension file to the PHP extension file location. The reference command is as follows

cp /usr/local/Cellar/php71/7.1.14_25/lib/php/extensions/no-debug-non-zts-20160303/taint.so /usr/local/lib/php/pecl/20160303/

After the copy is completed, I need to edit the configuration file and change the taint Copy the configuration items into

vim /usr/local/etc/php/7.1/php.ini

Add Tain configuration items to the php.ini file. The reference configuration is as follows:

[taint]
extension=taint.so
taint.enable=1
taint.error_level=E_WARNING

4.3 Verification of installation results

After saving the configuration file and exiting, it means that the author's installation has been completed. Now you need to restart PHP to make it take effect. The reference command is as follows

brew services restart php@7.1

After the restart is completed, you can use the command to check whether the current extension of PHP has Taint. The reference command is as follows:

php -i | grep taint

If the following information appears in the return result, the installation has basically been successful.

taint
taint support => enabled
taint.enable => On => On
taint.error_level => 2 => 2

5. Function inspection and testing

After completing the above two-step operation, the author has completed the installation phase. Now I need to use taint to verify the effect. It is divided into three parts. First, use the demo code of the author of taint to test, then use the penetration testing system permeate to test, and finally use the code that the author usually develops to test.

5.1 Demo file test

The purpose of testing with demo file is to verify whether the taint installed by the author has really taken effect, and to confirm whether the taint is meaningful.

5.1.1 Copy the demo code

There is the following demo code on the author's GitHub. I copied it to the web directory and the location is as follows:

/Users/song/mycode/safe/permeate

The demo code content is as follows, readers can copy it when experimenting:

<?php $a = trim($_GET[&#39;a&#39;]);

$file_name = &#39;/tmp&#39; .  $a;
$output    = "Welcome, {$a} !!!";
$var       = "output";
$sql       = "Select *  from " . $a;
$sql      .= "ooxx";

echo $output;

print $$var;

include($file_name);

mysql_query($sql);

5.1.2 Configuring the virtual host

After the code file is saved, The author needs to add a virtual host to the nginx configuration file for browser access to this file. The reference configuration is as follows:

    server {
        listen       80;
        server_name  test.localhost;
        root  /Users/song/mycode/safe/permeate;
        location / {
            index index.html index.htm index.php; 
        }

        location ~ \.php$ {
            fastcgi_pass   127.0.0.1:9000;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
            include        fastcgi_params;
        }
    }

5.1.3 Browser access

Continue The author accesses the corresponding code file through the browser, and the URL address is as follows:

http://test.localhost/taintdemo.php?a=1

After the browser accesses the page, the author can see some warning messages on the page, the content is as follows:

Warning: main() [echo]: Attempt to echo a string that might be tainted in /Users/song/mycode/work/test/taintdemo.php on line 10
Welcome, 1 !!!
Warning: main() [print]: Attempt to print a string that might be tainted in /Users/song/mycode/work/test/taintdemo.php on line 12
Welcome, 1 !!!
Warning: main() [include]: File path contains data that might be tainted in /Users/song/mycode/work/test/taintdemo.php on line 14

Warning: include(/tmp1): failed to open stream: No such file or directory in /Users/song/mycode/work/test/taintdemo.php on line 14

Warning: include(): Failed opening '/tmp1' for inclusion (include_path='.:/usr/local/Cellar/php@7.1/7.1.19/share/php@7.1/pear') in /Users/song/mycode/work/test/taintdemo.php on line 14

Fatal error: Uncaught Error: Call to undefined function mysql_query() in /Users/song/mycode/work/test/taintdemo.php:16 Stack trace: #0 {main} thrown in /Users/song/mycode/work/test/taintdemo.php on line 16

从警告信息当中可以看出，笔者的taint已经生效，给出了很多警告提示，提示参数可能受到污染，因为参数并没有经过任何过滤；

5.1.4 参数过滤测试

如果不想让taint给出警告提示，可以将demo代码中的第二行代码更改或增加一下过滤规则，参考代码如下：

$a = htmlspecialchars($_GET['a']);

再次回到浏览器当中，刷新当前页面，可以看到返回的信息已经发生了变化，返回内容如下

Welcome, 1 !!!Welcome, 1 !!!
Warning: include(/tmp1): failed to open stream: No such file or directory in /Users/song/mycode/work/test/taintdemo.php on line 15

Warning: include(): Failed opening '/tmp1' for inclusion (include_path='.:/usr/local/Cellar/php@7.1/7.1.19/share/php@7.1/pear') in /Users/song/mycode/work/test/taintdemo.php on line 15

Fatal error: Uncaught Error: Call to undefined function mysql_query() in /Users/song/mycode/work/test/taintdemo.php:17 Stack trace: #0 {main} thrown in /Users/song/mycode/work/test/taintdemo.php on line 17

因为笔者在代码中增加了参数转义，此时再次刷新浏览器，会看到taint不再给发出警告提醒。

5.2 渗透测试系统验证

用demo系统验证taint扩展生效之后，现在笔者将用一个渗透测试系统来做一个实验，在这个系统中本身存在了很多安全问题，使用taint来找出这些问题，使用的渗透测试系统为 permeate渗透测试系统,地址如下

https://git.oschina.net/songboy/permeate

5.2.1 下载permeate

笔者通过git将其源码下载下来，参考命令如下

https://gitee.com/songboy/permeate.git

下载下来之后，同样创建一个虚拟主机，可以参考上面的nginx配置

5.2.2 导入数据库

因为这个系统会用到数据库，所以笔者下载之后需要新建数据库给permeate使用

新建完成数据库之后，笔者需要将一些数据表结构以及初始化数据导入到数据库当中，在使用git下载下来之后，在其跟目录有一个doc的文件夹，笔者打开它之后，能看到有一个sql文件，如下图所示

打开此文件并将其里面的内容复制，将复制的内容到管理数据库的Navicat Premium当中，然后执行这些SQL语句，如下图所示

5.2.3 修改配置文件

导入数据库完成之后，笔者修改数据库配置文件，让permeate能够连接次数据库，配置文件在根目录 conf/dbconfig.php,里面的配置代码如下，将其地址账户以及密码和数据库名称一一对应填写

<?php     !defined(&#39;DB_HOST&#39;) && define(&#39;DB_HOST&#39;,&#39;127.0.0.1&#39;);
    !defined(&#39;DB_USER&#39;) && define(&#39;DB_USER&#39;,&#39;root&#39;);
    !defined(&#39;DB_PASS&#39;) && define(&#39;DB_PASS&#39;,&#39;root&#39;);
    !defined(&#39;DB_NAME&#39;) && define(&#39;DB_NAME&#39;,&#39;permeate&#39;);
    !defined(&#39;DB_CHARSET&#39;) && define(&#39;DB_CHARSET&#39;,&#39;utf8&#39;);
    $sex=array(&#39;保密&#39;,&#39;男&#39;,&#39;女&#39;);
    $edu=array(&#39;保密&#39;,&#39;小学&#39;,&#39;初中&#39;,&#39;高中/中专&#39;,&#39;大专&#39;,&#39;本科&#39;,&#39;研究生&#39;,&#39;博士&#39;,&#39;博士后&#39;);
    $admins=array(&#39;普通用户&#39;,&#39;管理员&#39;)

5.2.4 验证安装结果

设置好数据库之后，笔者安装permeate便已经完成了，此时打开首页，看到的界面应该如下图所示：

如果在首页当中没有看到板块以及分区等信息，很有可能是数据库没有连接成功或者数据库没有正确导入数据所致。

5.2.5 挖掘漏洞

下面开始进行测试，笔者点击第一个板块SQL注入，并点击列表下发的下一页按钮，此时看到的页面如下图所示：

在这个板块列表页中没看到任何问题，但是实际上taint已经给笔者发出了警告提醒。

笔者可以通过查看源代码时候来看到这些问题，如下图所示，taint提示在代码文件 /Users/song/mycode/safe/permeate/core/common.php的50行，存在参数被污染的情况。

5.2.5 漏洞分析

笔者找到对应的代码位置，发现代码内容如下：

function includeAction($model, $action)
{
    //判断控制器是否存在
    $filePath = "./action/$model.php";
    if (is_readable($filePath)) {
        require_once $filePath;
        $class = new $model;
        if (is_callable(array($class, $action))) {
            $class->$action();
            return true;
        }
    }

在代码中笔者看到有一个require_once函数加载了文件，里面的参数使用了变量 $model 和 $action ,通过最终变量来源，在代码文件/Users/song/mycode/safe/permeate/home/router.php发现这两个参数确实没有经过过滤，如下代码所示:

<?php require_once "/core/common.php";
$model = !empty($_GET[&#39;m&#39;]) ? $_GET[&#39;m&#39;] : &#39;index&#39;;
$action = !empty($_GET[&#39;a&#39;]) ? $_GET[&#39;a&#39;] : &#39;index&#39;;

includeAction("$model","$action");

最后需要提醒大家，Taint在开发环境安装即可，不要安装到生产环境当中，否则可能会把网站的安全问题直接暴露给攻击者

相关推荐：

PHP网站常见安全漏洞及相应防范措施总结，安全漏洞防范措施

Security vulnerabilities caused by debug in new PHP vulnerability mining (Edusoho)

##PHPShop has multiple security vulnerabilities_PHP tutorial

The above is the detailed content of How PHP extension Taint finds potential security vulnerabilities in websites (must read). For more information, please follow other related articles on the PHP Chinese website!