// HackTricks · Network Services

PHP 5.2 fopen safemode Bypass

PHP 5.2 fopen safe_mode Bypass

This historical local exploit targets a safe_mode restriction-bypass issue reported in PHP 5.2.0. In a shared-hosting scenario where an attacker could already execute PHP code, a crafted srpath:// URI passed to fopen could write a file outside the intended location.[1] This is not a general bypass for modern PHP because safe_mode and its related configuration options were removed in PHP 5.4.[2]

php -r 'fopen("srpath://../../../../../../../dir/pliczek", "a");'

References

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.