One of the more ingenious PHP exploitation techniques from the early days wasn't
a vulnerability by itself. It was the realization that two seemingly harmless
weaknesses could be chained together into remote code execution.
Back when Local File Inclusion (LFI) vulnerabilities were everywhere, attackers
discovered that web server log files could become an unexpected attack vector.
Every HTTP request gets written to a log, including headers like the User-Agent.
If an application contained an LFI vulnerability and the server allowed those
log files to be included by PHP, the contents of the log could end up being
interpreted as PHP instead of simple text.
The interesting part wasn't the LFI itself. It was the combination of an LFI
bug, writable log files, and PHP parsing an included file that turned what
looked like a simple file disclosure issue into something much more dangerous.
This became one of the classic examples of exploit chaining and changed how many
developers viewed web security. It wasn't enough to fix individual bugs anymore.
You had to think about how independent weaknesses could interact with each
other. Modern frameworks and hardened server configurations have made this
particular attack far less common, but it's still one of my favorite examples of
how creative attackers used to think.
Some of the older PHP exploits may seem primitive compared to today's attack
chains, but they laid the foundation for many of the defensive practicies we
take for granted now.
Basically, to make this simple to understand, you made sure the code was logged
and then used the log file as your included (LFI) file to execute the malicious
code.
wormy
"Check everything"