Re: Arbitrary code execution in eping plugin
On 11 Jun 2005 20:15:09 -0000, oliver@xxxxxxxxxxxxx
<oliver@xxxxxxxxxxxxx> wrote:
> So only IP-Adresses are allowed and no kind of code injection is possible.
I'm unfamiliar with this particular program, so forgive me if I'm way
off base...however...give this a try:
function eping_validaddr($eping_hosttocheck)
{
return ip2long($eping_hosttocheck);
}
On a failure, it will return (int)-1 or (bool)FALSE depending on your
PHP version. Before doing the actual ping, you'll want to grab the
result of eping_validaddr() and run it through long2ip() as a final
step of validation. Example:
$exploit = long2ip(ip2long('127.0.0.1;commands%20here'));
It will populate $exploit with (string)"255.255.255.255" (just
ip2long() alone on that returns -1 in PHP4 or FALSE in PHP5).
Sam