fate0 / xmark

A PHP7 extension that can hook most functions/classes and parts of opcodes
BSD 3-Clause "New" or "Revised" License
239 stars 32 forks source link

Using this project, along with prvd, but renaming classes does not seem to work #7

Open pentestusa opened 4 years ago

pentestusa commented 4 years ago

Ok, so, I posted this issue earlier, and managed to fix it myself.

PHP loads modules in the /etc/php/7.2/apache/conf.d/ directory. It loads them AFTER the php.ini file is loaded. The mysqli/pdo/sqlite3 modules are loaded from the conf.d directory, which means if you have your [xmark] directives in your php.ini file, they will not be able to rename classes as they will not have been loaded yet.

My solution was to add a file to the /etc/php/7.2/apache/conf.d/ directory "30-xmark.ini" and add my xmark module configuration there. After doing that, the classes were successfully renamed and hooking worked successfully.

======= UNFIXED ISSUE TEXT ============

Hi, this is a great project, and it works fantastically for function hooking, however using it along with prvd I noticed that class renaming isn't taking place.

I'm looking at Utils.php, in prvd_load_file($pattern) and despite having my php.ini configured to rename SQLite3, mysqli, and PDO, the classes prvd_SQLite3, prvd_mysqli, and prvd_PDO do not exist, which suggests to me that xmark is not renaming them.

The output of my prvd log is as follows:

error: function/class prvd_mysqli does not exists error: function/class prvd_pdo does not exists error: function/class prvd_pg_prepare does not exists error: function/class prvd_pg_query does not exists error: function/class prvd_pg_query_params does not exists error: function/class prvd_pg_send_prepare does not exists error: function/class prvd_pg_send_query does not exists error: function/class prvd_pg_send_query_params does not exists error: function/class prvd_sqlite3 does not exists

Again, function hooking works perfectly, but class hooking seems to not be working. Any help with this is appreciated.

My php.ini is as follows:

extension=/path/to/my/local/php_xmark_hooking/xmark/modules/xmark.so [xmark] xmark.enable = 1 xmark.rename_enable = 1 xmark.enable_rename = 1 xmark.rename_classes = " SQLite3:prvd_SQLite3, mysqli:prvd_mysqli, PDO:prvd_PDO " xmark.rename_functions = " base64_decode:prvd_base64_decode, basename:prvd_basename, dirname:prvd_dirname, explode:prvd_explode, gzuncompress:prvd_gzuncompress, hex2bin:prvd_hex2bin, html_entity_decode:prvd_html_entity_decode, htmlspecialchars_decode:prvd_htmlspecialchars_decode, implode:prvd_implode, join:prvd_join, json_decode:prvd_json_decode, ltrim:prvd_ltrim, pathinfo:prvd_pathinfo, rawurldecode:prvd_rawurldecode, rawurlencode:prvd_rawurlencode, rtrim:prvd_rtrim, sprintf:prvd_sprintf, str_ireplace:prvd_str_ireplace, str_pad:prvd_str_pad, str_replace:prvd_str_replace, strstr:prvd_strstr, strtolower:prvd_strtolower, strtoupper:prvd_strtoupper, substr:prvd_substr, trim:prvd_trim, urldecode:prvd_urldecode, urlencode:prvd_urlencode, vsprintf:prvd_vsprintf, exec:prvd_exec, passthru:prvd_passthru, popen:prvd_popen, proc_open:prvd_proc_open, shell_exec:prvd_shell_exec, system:prvd_system, unserialize:prvd_unserialize, copy:prvd_copy, dir:prvd_dir, file:prvd_file, file_get_contents:prvd_file_get_contents, file_put_contents:prvd_file_put_contents, fopen:prvd_fopen, glob:prvd_glob, highlight_file:prvd_highlight_file, link:prvd_link, move_uploaded_file:prvd_move_uploaded_file, opendir:prvd_opendir, readfile:prvd_readfile, rename:prvd_rename, rmdir:prvd_rmdir, scandir:prvd_scandir, show_source:prvd_show_source, unlink:prvd_unlink, mysqli_init:prvd_mysqli_init, mysqli_multi_query:prvd_mysqli_multi_query, mysqli_query:prvd_mysqli_query, mysqli_prepare:prvd_mysqli_prepare, mysqli_real_query:prvd_mysqli_real_query, pg_prepare:prvd_pg_prepare, pg_query:prvd_pg_query, pg_query_params:prvd_pg_query_params, pg_send_prepare:prvd_pg_send_prepare, pg_send_query:prvd_pg_send_query, pg_send_query_params:prvd_pg_send_query_params, curl_exec:prvd_curl_exec, fsockopen:prvd_fsockopen, get_headers:prvd_get_headers, print_r:prvd_print_r, printf:prvd_printf, vprintf:prvd_vprintf "