xiphosresearch / phuzz

Find exploitable PHP files by parameter fuzzing and function call tracing

PHP Hardening Phuzzer

It uses feedback from xdebug and strace to generate random and arbitrary input parameters to a PHP script and find code paths which lead to exploitation. Primarily it's designed to scan for vulnerabilities in PHP scripts which are web accessible but not meant to be run directly.

Features

• Detect input parameters, _GET, _POST, _REQUEST, _COOKIE and _FILES
• Generate random input parameters
• Find unique code paths
• systemcall tracing with strace and dtruss, tested on Linux & OSX
• PHP function call tracing, using Xdebug

TODO

• Make it suck less
• Analysis of collected Phuzz cases/traces, automatic exploit generation
• dtrace and systemtap support

Example

The first request is made to analyse which inputs the script uses.

[Thu Sep  8 17:36:00 2016] 127.0.0.1:36996 [200]: /rce1.php

It then generates random values for the required parameters, and finds all the PHP and system calls that.

[Thu Sep  8 17:36:00 2016] 127.0.0.1:36998 [200]: /rce1.php?cmd=SWGAGI55
<webroot>/rce1.php
	 system ( 'SWGAGI55' )

syscalls:
	 stat ( "/usr/local/sbin/SWGAGI55", 0x7ffff9f76140 )
	 stat ( "/usr/local/bin/SWGAGI55", 0x7ffff9f76140 )
	 stat ( "/usr/sbin/SWGAGI55", 0x7ffff9f76140 )
	 stat ( "/usr/bin/SWGAGI55", 0x7ffff9f76140 )
	 stat ( "/sbin/SWGAGI55", 0x7ffff9f76140 )
	 stat ( "/bin/SWGAGI55", 0x7ffff9f76140 )
	 stat ( "/usr/games/SWGAGI55", 0x7ffff9f76140 )
	 stat ( "/usr/local/games/SWGAGI55", 0x7ffff9f76140 )

Installation

Debian / Ubuntu

sudo apt-get install php5.6-cli php-xdebug
pip install -r requirements.txt

sudo sh -c 'echo 0 > /proc/sys/kernel/yama/ptrace_scope' python -mphuzz

OSX

brew install php56 php56-xdebug
pip install -r requirements.txt
python -mphuzz

Microsoft Windows (XP or above)

• Click on Start button (bottom left hand corner of screen)
• Click My Computer
• Navigate to C:\Program Files (Intel X86 Architecture)\Microsoft Internet Explorer Professional Edition 2016\
• Locate iexplore.exe, you may have to use the scroll bars
• Click on it... twice, quickly!
• Wait until new window opens up
• Find the white bar with http://worldwideweb.msn.com/en-US/infestedmalwaresmegma.exe in it
• Click the text, just once!
• Press the Ctrl and A buttons on your keyboard, together, at the same time.
• Type in www.google.com
• Wait until your computer starts responding again
• Type in Self immolation techniques for beginners
• Press the Search button
• Follow instructions until warm throughout

TL;DR any ideas on porting this to Win32 API?

phuzz's Issues

Real-world test case, wordpress + most used plugins

A "hard problem" (which may be out of scope) to solve is the issue with dynamic web apps that have a fuck tonne of dependencies and rely on a database.

An example of this is the vast majority of wordpress plugins.

It would be interesting to be able to point phuzz at the webroot of an installed/configured Wordpress/whatever instance (with whatever plugins) and let it rip. Hooking calls to the database would also help with detecting SQLi, etc.

This functionality may already be possible in the applications current state, I'll have to run some tests later.

Classify types of exploits, based on trace results

With results of the traces we should be able to determine which category of bug it is. A classifier needs to match function calls and parameters, then output appropriate Tags. e.g.

• str_replace = FilterStrReplace
• mysql_real_escape = SqlEscape
• stat/open = LocalFile
• system = CmdExecution
• connect/send = Network

This fits into the project because it will form the basis of the analyser and exploiter in the level above, e.g. 'LocalFile+CodeExecution' - RCE. The tags will be used to determine what modifications to make to the input parameters to verify the level of control over them, see if there's filtering etc.

Progress Bar or Indicator when scanning directories of files

A nice addition for usability would be to have a progress indicator for when large amounts of files are being scanned. Even something as simple as "X/Y Files Scanned - Z% Complete" would be decent.

A further enhancement to this would be a "time elapsed/estimated time remaining" counter.

Phuzz can hang indefinitely, must set execution cap

While analysing lots of files we found a situation where Phuzz would hang indefinitely because of ... shrug some combination of PHP and TCP sockets.

There needs to be an enforced time-out, so Phuzz will kill PHP after 10 seconds of no response, or 60 seconds overall (both configurable).

Tracing must resume afterwards.

Windows support?

Implement using http://www.howzatt.demon.co.uk/NtTrace/ or http://intellectualheaven.com/default.asp?BH=StraceNT

Too much effort at the moment

URL creation still broken

I have no idea why this bug is still cropping up... Backtrace below.

# python -m phuzz -o output/ -t tests/ -d
DEBUG:phuzz:Waiting for server...
PHP 5.6.4-4ubuntu6.4 Development Server started at Sun Sep 18 14:47:57 2016
Listening on http://127.0.0.1:25581
Document root is /scratch/skyhigh/wordpress-research/phuzz/tests
Press Ctrl-C to quit.
[Sun Sep 18 14:47:57 2016] 127.0.0.1:50010 Invalid request (Unexpected EOF)
INFO:phuzz:SyscallTracer started, pid: 14257
INFO:__main__:Scanning all files in tests/
DEBUG:phuzz:Retrieving 'http://127.0.0.1:25581afu1.php'
ERROR:__main__:FAIL...
Traceback (most recent call last):
  File "/scratch/skyhigh/wordpress-research/phuzz/phuzz/__main__.py", line 41, in main
    worker.run_file(os.path.join(path, filename))
  File "phuzz/__init__.py", line 415, in run_file
    return self.run_path(webpath)
  File "phuzz/__init__.py", line 420, in run_path
    return self.run(url)
  File "phuzz/__init__.py", line 428, in run
    trace = self.trace(url, state)
  File "phuzz/__init__.py", line 381, in trace
    resp = self._request_for_state(url, state)
  File "phuzz/__init__.py", line 374, in _request_for_state
    allow_redirects=False)
  File "/home/skyhighatrist/.local/lib/python2.7/site-packages/requests/sessions.py", line 454, in request
    prep = self.prepare_request(req)
  File "/home/skyhighatrist/.local/lib/python2.7/site-packages/requests/sessions.py", line 388, in prepare_request
    hooks=merge_hooks(request.hooks, self.hooks),
  File "/home/skyhighatrist/.local/lib/python2.7/site-packages/requests/models.py", line 293, in prepare
    self.prepare_url(url, params)
  File "/home/skyhighatrist/.local/lib/python2.7/site-packages/requests/models.py", line 347, in prepare_url
    raise InvalidURL(*e.args)
InvalidURL: Failed to parse: 127.0.0.1:25581afu1.php
DEBUG:phuzz:SyscallTracer stopped, pid: 14257