Phpをいじり倒す10の方法

“ ” 10 10 ways to “exploit” PHP that you might not know

brushup: What is PHP? The most overengineered template engine ever. Often mistaken as a sort of programming language due to its “your-favorite-language-like” syntatic features. The world’s first template engine upon which another template engine is implemented.

Uh, so... do you mean PHP is not a programming language?

Why not customize PHP so it would ﬁt more to your project?

Extensions SAPI ZendEngine2 SAPI module

threads Slot #1 TLS Slot #2 TLS module global Slot #n TLS

zend_objects.c zend_object_handlers.c zend_objects_API.c zend_alloc.c Objects API Allocator zend_execute.c zend_API.c zend_execute_API.c zend_float.c zend_vm_execute.h zend_operators.c Virtual Machine Utilities zend_stream.c zend_qsort.c zend_gc.c Garbage Stack Linked List Collector zend_compile.c zend_stack.c zend_opcode.c Hashtable zend_ptr_stack.c Opcode emitter zend_llist.c basic data structure zend_hash.c Parser Lexer Parser Lexer zend_language_parser.y zend_language_scanner.l zend_ini.c language core ini parser zend_ini_parser.y zend_ini_scanner.c

<?php ? $a = 1; $b = 2; $c = $a + $b; ?>

T_OPEN_TAG <?php T_VARIABLE $a = 1; ‘=’ $b = 2; T_LNUMBER $c = $a + $b; ‘;’ ?> T_VARIABLE ‘=’ T_LNUMBER ‘;’ T_VARIABLE ‘=’ Lexer T_VARIABLE ‘+’ T_VARIABLE ‘;’ T_CLOSE_TAG

zend_op T_OPEN_TAG ASSIGN T_VARIABLE ‘=’ zend_op T_LNUMBER ‘;’ ASSIGN T_VARIABLE zend_op ‘=’ T_LNUMBER ADD ‘;’ T_VARIABLE zend_op ‘=’ T_VARIABLE ASSIGN ‘+’ T_VARIABLE ‘;’ zend_op_array T_CLOSE_TAG Parser Opcode emitter

opcode handler result op1 op2 extended_value zend_op

op_type opline_num constant var op_array jmp_addr

$a = $b + $c + $d; ASSIGN result ADD op1 op2 ADD ADD ASSIGN result op1 op2 ADD result op1 op2 TMP_VAR

zend_op ASSIGN ASSIGN zend_op FETCH_R ASSIGN zend_op FETCH_W ADD zend_op FETCH_DIM_R ASSIGN FETCH_DIM_W zend_op_array ECHO ADD handlers

array(1, 2, 3, 4, 5)->join(’,’) Java autoboxing PHP ? autobox __autobox()

<?php $a = << ?><?html> <body> <?div id=”{$id}”>test</?div> </body> </?html> <?php // $a DOM var_dump($a); ?>

Boost.PHP

#include "boost/php/module.hpp" #include "boost/php/function.hpp" using namespace boost; class m001_module : public php::module, public php::function_container<m002_module> { public: class handler : public php::module::handler { public: handler(m001_module* mod) :php::module::handler(mod) {} }; public: m001_module(zend_module_entry* entry) : php::module(entry) { // entry->functions = defun("your_function", &handler::your_function); } }; #define BOOST_PHP_MODULE_NAME m001 #define BOOST_PHP_MODULE_CAPITALIZED_NAME M001 #define BOOST_PHP_MODULE_VERSION "0.1" #define BOOST_PHP_MODULE_CLASS_NAME m001_module #include "boost/php/module_def.hpp"

defun(”function_name”, )

Thank you for listening!

http://d.hatena.ne.jp	522
http://sasezaki.hatenablog.com	483
http://cptl.corp.yahoo.co.jp	21
http://www.slideshare.net	20
http://twitter.com	2
http://localhost	1

Phpをいじり倒す10の方法

by Moriyoshi Koizumi on Sep 05, 2009

Accessibility

Categories

Tags

Upload Details

Usage Rights

6 Embeds 1,049

Statistics

Phpをいじり倒す10の方法 — Presentation Transcript