Merge pull request #2087 from HackTricks-wiki/research_update_src_network-services-pentesting_pentesting-web_php-tricks-esp_php-useful-functions-disable_functions-open_basedir-bypass_disable_functions-bypass-dl-function_20260402_132743

Research Update Enhanced src/network-services-pentesting/pen...

Author: carlospolop

src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-dl-function.md

@@ -2,91 +2,133 @@
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-**Important note:**
+`dl()` lets PHP load a shared extension at runtime. If you can make it load an attacker-controlled module, you can register a new PHP function that internally calls `execve`, `system`, or any other native primitive and therefore bypass `disable_functions`.
 
-![image](https://user-images.githubusercontent.com/84577967/174675487-a4c4ca06-194f-4725-85af-231a2f35d56c.png)
+This is a **real** primitive, but on modern targets it is far less common than older writeups suggest.
 
-**`dl`** is a PHP function that can be used to load PHP extensions. It the function isn't disabled it could be abused to **bypass `disable_functions` and execute arbitrary commands**.\
-However, it has some strict limitations:
+## Why this bypass is uncommon today
 
-- The `dl` function must be **present** in the **environment** and **not disabled**
-- The PHP Extension **must be compiled with the same major version** (PHP API version) that the server is using (you can see this information in the output of phpinfo)
-- The PHP extension must be **located in the directory** that is **defined** by the **`extension_dir`** directive (you can see it in the output of phpinfo). It's very unprobeable that an attacker trying to abuse the server will have write access over this directory, so this requirement probably will prevent you to abuse this technique).
+The main blockers are:
 
-**If you meet these requirements, continue reading the post** [**https://antichat.com/threads/70763/**](https://antichat.com/threads/70763/) **to learn how to bypass disable_functions**. Here is a summary:
+- `dl()` must exist and must not be disabled
+- `enable_dl` must still allow dynamic loading
+- The target SAPI must support `dl()`
+- The payload must be a valid PHP extension compiled for the **same target ABI**
+- The extension must be reachable from the configured `extension_dir`
 
-The [dl function](http://www.php.net/manual/en/function.dl.php) is used to load PHP extensions dynamically during script execution. PHP extensions, typically written in C/C++, enhance PHP's functionality. The attacker, upon noticing the `dl` function is not disabled, decides to create a custom PHP extension to execute system commands.
+The official PHP manual is the most important reality check here: **`dl()` is only available for CLI and embed SAPIs, and for the CGI SAPI when run from the command line**. That means the technique is **usually not available in normal PHP-FPM/mod_php web requests**, so check the SAPI before spending time building a payload.
 
-### Steps Taken by the Attacker:
+Also note that `enable_dl` is an `INI_SYSTEM` setting and, as of **PHP 8.3.0**, PHP documents it as **deprecated**, so you usually cannot flip it at runtime from attacker-controlled PHP code.
 
-1. **PHP Version Identification:**
+If `dl()` is not viable, go back to the broader list of [module/version dependent bypasses](README.md).
 
-   - The attacker determines the PHP version using a script (`<?php echo 'PHP Version is '.PHP_VERSION; ?>`).
+## Fast triage from a foothold
 
-2. **PHP Source Acquisition:**
+Before building anything, collect the exact parameters that the module must match:
 
-   - Downloads the PHP source from the official [PHP website](http://www.php.net/downloads.php) or the [archive](http://museum.php.net) if the version is older.
+```php
+<?php
+phpinfo();
+echo "PHP_VERSION=" . PHP_VERSION . PHP_EOL;
+echo "PHP_SAPI=" . php_sapi_name() . PHP_EOL;
+echo "ZTS=" . (PHP_ZTS ? "yes" : "no") . PHP_EOL;
+echo "INT_BITS=" . (PHP_INT_SIZE * 8) . PHP_EOL;
+echo "enable_dl=" . ini_get("enable_dl") . PHP_EOL;
+echo "extension_dir=" . ini_get("extension_dir") . PHP_EOL;
+echo "disabled=" . ini_get("disable_functions") . PHP_EOL;
+?>
+```
 
-3. **Local PHP Setup:**
+What you care about:
 
-   - Extracts and installs the specific PHP version on their system.
+- `PHP_SAPI`: if this is `fpm-fcgi` or `apache2handler`, `dl()` is usually a dead end for web exploitation
+- `extension_dir`: the payload must be loaded from here
+- `PHP Version`, architecture, debug/non-debug, and ZTS/non-ZTS: your module must match them
+- `disable_functions`: confirm whether `dl` is absent because it is disabled or because the SAPI does not support it
 
-4. **Extension Creation:**
-   - Studies [creating PHP extensions](http://www.php.net/manual/en/zend.creating.php) and inspects the PHP source code.
-   - Focuses on duplicating the functionality of the [exec function](http://www.php.net/manual/en/function.exec.php) located at `ext/standard/exec.c`.
+## Practical exploitation constraints
 
-### Notes for Compiling the Custom Extension:
+### 1. You normally need write access to `extension_dir`
 
-1. **ZEND_MODULE_API_NO:**
+This is the biggest bottleneck.
 
-   - The `ZEND_MODULE_API_NO` in `bypass.c` must match the current Zend Extension Build, retrievable with:
-     ```bash
-     php -i | grep "Zend Extension Build" |awk -F"API4" '{print $2}' | awk -F"," '{print $1}'
-     ```
+`dl()` takes the **extension filename**, and PHP loads it from `extension_dir`. In practice, this means that a normal arbitrary file upload to `/var/www/html/uploads` is not enough. You still need a path to place a `.so`/`.dll` where PHP will actually load extensions from.
 
-2. **PHP_FUNCTION Modification:**
-   - For recent PHP versions (5, 7, 8), `PHP_FUNCTION(bypass_exec)` may need adjustment. The provided code snippet details this modification.
+Realistic situations where this becomes exploitable:
 
-### Custom Extension Files:
+- CTFs or intentionally weak labs where `extension_dir` is writable
+- Shared-hosting or container mistakes that expose a writable extension path
+- A separate arbitrary file write primitive that already reaches `extension_dir`
+- Post-exploitation scenarios where you already escalated enough to drop files there
 
-- **bypass.c**:
-  - Implements the core functionality of the custom extension.
-- **php_bypass.h**:
-  - Header file, defining extension properties.
-- **config.m4**:
-  - Used by `phpize` to configure the build environment for the custom extension.
+### 2. The module must match the target build
 
-### Building the Extension:
+Matching only `PHP_VERSION` is not enough. The extension also needs to match:
 
-1. **Compilation Commands:**
+- OS and CPU architecture
+- libc/toolchain expectations
+- `ZEND_MODULE_API_NO`
+- debug vs non-debug build
+- ZTS vs NTS
 
-   - Uses `phpize`, `./configure`, and `make` to compile the extension.
-   - Resulting `bypass.so` is then located in the modules subdirectory.
+If those do not match, `dl()` will fail or crash the process.
 
-2. **Cleanup:**
-   - Runs `make clean` and `phpize --clean` after compilation.
+### 3. `open_basedir` is not the main defense here
 
-### Uploading and Executing on the Victim Host:
+Once you can place the module in `extension_dir` and call `dl()`, the extension code executes inside the PHP process. At that point the relevant barrier was not `open_basedir`, but the ability to land a valid shared object in the extension loading path.
 
-1. **Version Compatibility:**
+## Building the malicious extension
 
-   - Ensures PHP API versions match between the attacker's and victim's systems.
+The classic route is still valid:
 
-2. **Extension Loading:**
+1. Recreate the victim build as closely as possible
+2. Use `phpize`, `./configure`, and `make` to build a shared extension
+3. Export a PHP function such as `bypass_exec($cmd)` that wraps native command execution
+4. Upload the compiled module into `extension_dir`
+5. Load it with `dl()` and call the exported function
 
-   - Utilizes the `dl` function, circumventing restrictions by using relative paths or a script to automate the process.
+The attack is old, but still relevant because PHP 8.x changelogs continue to include `dl()`-specific crash fixes. The primitive still exists; the hard part is finding a deployment where it is reachable and where you can land a matching module.
 
-3. **Script Execution:**
-   - The attacker uploads `bypass.so` and a PHP script to the victim's server.
-   - The script uses `dl_local` function to dynamically load `bypass.so` and then calls `bypass_exec` with a command passed via the `cmd` query parameter.
+## Minimal workflow
 
-### Command Execution:
+### On the attacker box
 
-- The attacker can now execute commands by accessing: `http://www.example.com/script.php?cmd=<command>`
+```bash
+mkdir bypass && cd bypass
+phpize
+./configure
+make
+```
 
-This detailed walkthrough outlines the process of creating and deploying a PHP extension to execute system commands, exploiting the `dl` function, which should ideally be disabled to prevent such security breaches.
+The resulting shared object will usually be under `modules/`.
 
-{{#include ../../../../banners/hacktricks-training.md}}
+If you are building on a different environment than the target, treat the produced file as a draft until you verify that the ABI matches the victim.
+
+## Loading and using the extension
+
+If the target really supports `dl()` and the module is inside `extension_dir`, the runtime side is simple:
+
+```php
+<?php
+if (!extension_loaded('bypass')) {
+    dl('bypass.so'); // use the correct filename for the target platform
+}
+echo bypass_exec($_GET['cmd']);
+?>
+```
 
+On Windows the filename will typically be a `.dll`, while on Unix-like targets it will usually be a `.so`.
 
+## Attacker notes
 
+- Do not assume this works remotely just because `function_exists("dl")` returns true in some documentation or old writeup; validate the live SAPI
+- A failed `dl()` attempt may kill the PHP worker if the module is incompatible
+- From PHP 8 onward, disabled functions are removed from the function table, so userland enumeration may differ from older posts
+- If you cannot write to `extension_dir`, this technique is usually less practical than FPM/FastCGI, `LD_PRELOAD`, or module-specific bypasses already covered in this section
+
+## References
+
+- [PHP manual: dl](https://www.php.net/manual/en/function.dl.php)
+- [Tarlogic: A deep dive into disable_functions bypass and PHP exploitation](https://www.tarlogic.com/blog/disable_functions-bypasses-php-exploitation/)
+
+{{#include ../../../../banners/hacktricks-training.md}}