« first day (1445 days earlier)      last day (3503 days later) » 

5:00 PM
1
Q: Bypass string concat in php readfile for LFD exploit

Lorenzo WillsI'm taking a course on software security and have been presented with the following scenario: PHP CODE RUNNING ON SERVER: <?php header("Content-Type: application/octet-stream"); header("Content-Disposition: attachment; filename=response.txt"); readfile($_GET['file']."/remove/this.t...

Anyone has an idea?
 
@PeeHaa their definition of quality really has nothing to do with quality =]
 
@RonniSkansing I don't think all of their stuff is utter shit tbh. I just don't like how they work
 
@PeeHaa Open sounds cool but I see too many idiots in the open :P
 
@PeeHaa well, SO isn't curated, it's moderated. Which is a different, but useful thing
 
@ircmaxell yeah I realize that. Problem is (which is also the reason I didn't follow through last time) that I am not sure what will work
 
5:02 PM
@bwoebi \0 maybe
 
@RonniSkansing no, doesn't work.
 
@bwoebi I suspect you can do something with path length truncation
 
@PeeHaa Do you mean PHP builds or are you talking tertiary stuff like PECL, etc?
 
On one hand I want curated because that is easy, but I don't want to be the one that says that one is ok but that one is not allowed
 
@PeeHaa let's talk about it more, because I am interested in that
 
5:03 PM
But the drawback of moderated is basically that current state of SO now
 
drawback/biggest strength
 
@Machavity Something like phpclasses.org only not terrible
@ircmaxell Yeah true
But you need a strong community of smart people to make that work
I'm a bit afraid whether that can be pulled of
Maybe my worries are not needed, but it is something I think about
 
@NikiC file_get_contents(str_repeat("/", 4096 - 13)."/etc/passwdGARBAGE") … doesn't work.
 
However it may be able to try to steer the community to let the "pearls" get the exposer they need
I would really love to be able to setup some resource like that in some way
 
@bwoebi it could be used to inject a url..
 
5:14 PM
@RonniSkansing yeah, it's about reading files here
 
Please upvote @Danack's post here
Oh looks like it's been discussed.
 
WHY THE COCK DOES filter_var($amount, FILTER_SANITIZE_NUMBER_FLOAT); TURN 1.23 INTO 123.
 
because SANITIZE is evil
 
@Danack eek
 
filter_var($amount, FILTER_SANITIZE_NUMBER_FLOAT, FILTER_FLAG_ALLOW_FRACTION); - because apparently fractions in a floating point number are a special case.
 
5:24 PM
never sanitize.
 
@ircmaxell just accept the default behaviour that PHP does for a user input string that needs to be multiplied by 100 to get a value in cents? and then sanity check it?
 
no, validate. If it doesn't look right, reject it. Don't try to make it work
 
@Danack usually just cast to (int), when it's nothing critical.
 
@bwoebi casting is too late:
$input = "1e2";
echo $input * 100;
technically valid.....not actually going to be what the customer service person wanted to do.
 
Is that an issue when the 1e2 is converted to 100?
He shouldn't have inserted that at all.
When he inserts shit, his problem.
 
5:27 PM
Yes - so it's far more likely that a cat entered it rather than a human.
 
yep
Just like a cat also might run over the numpad, so nothing you really could prevent here.
 
You clearly need middleware to help prevent that bitboost.com/pawsense/cat-like-typing-detected.gif
 
yay
 
@Charles wahahaha Didn't know PHP was as bad as Windows :-D
 
5:41 PM
@bwoebi Man, that's even worse.
 
@Charles no, PHP isn't worse than Win, definitely not^^
 
Here goes #CommitStrip comic book bit.ly/1DW8LyX
 
saw that, in a meeting, will read and respond when I am done
 
> So please, reconsider using Futures
no
 
5:44 PM
go ahead and reply :-)
 
So Microsoft now joins OSX with Windows X?
 
> The GuzzleHttp\Ring\Client\StreamAdapter uses PHP’s http stream wrapper to send requests. This adapter cannot send requests concurrently.
I can't, I just ... can't ...
why do we make this so complicated in php ...
 
can someone tell me., how to sum up a column values that matches with given user id....please.
A--2 A--3 B--5(i have to sum only A values.how can i do it please help)
 
6:12 PM
@ircmaxell today I discovered atmel.com/devices/ATAES132.aspx this chip costs $1
it has shielding, anti-tamper and encrypted internal memory for key-storage... I'd say that's a bargain...
 
OK WHO HIRED THE ENTIRE PHP INTERNALS TEAM TO NAME MICROSOFT’S NEXT OS
5
 
@Danack ++
 
6:47 PM
There's too much emotional baggage with Windows 9, let's call it Windows 10 instead! Sound familiar, #PHP? http://www.cnet.com/news/microsoft-jumps-to-windows-10/
eve monring
 
yo
 
$a = 1; $f = function () use ($a) {}; /vs/ $f = function () use (1 as $a) {}; -- the latter seems ... oddly more fitting to me.
Better exemplified with more complex expressions or variables; function () use ($a as $b) {} or function () use (($a + 1) as $b) {}
 
eih
I'd argue that if you're doing that, perhaps you don't want a closure but an object
especially seeing as you could just add the 1 inside the closure
 
7:17 PM
Hi Room
any one can help me for this problem: stackoverflow.com/questions/26127531/…
 
@DanLugg Don't see the point
 
Just syntax.
@ircmaxell Yea, you're right; it just reads easier to me.
 
Well if something like that were possible, I'd rather use($a = 1) etc, would read more naturally if syntax complemented arg default vals IMO
@EricFavoni Seems likely that the table with the checkboxes in is not inside the <form> so the data is not being submitted with the form, but you don't show the full HTML structure so it's hard to know for sure
/me is out at the shops for half hour or so
 
@DaveRandom Oh Your Right. Thanks Bro
 
8:00 PM
@PeeHaa yeah, buy for 25$. lol.
 
I want to use CURRENT_TIMESTAMP for my default, buy my date is datetime and not timestamp. Do you know what is the "CURRENT_TIMESTAMP " for datetime columns?
 
@Marby mysql sucks
 
@Marby what are we talking about NOW() ?
 
New versions allow it
Starting from 5.6 IIRC
 
arg, I hate xdebug
 
Why do we have both Traversable and Iterator? Wouldn't it make more sense to simply have Iterator?
 
No, you hate Derick thus you hate xdebug.
 
I dont think so, Im trying like this: ALTER TABLE subscription CHANGE date_register date_register DATETIME NOT NULL NOW(); (And Im havin an error)
 
@PeeHaa Nice.
 
@Marby What is your mysql version?
 
8:10 PM
Server version: 5.5.38
 
@Marby option A: update your mysql instance. Option B: use timestamp column instead
 
@ThW you think it was possible to convert these moves realtime with such precision? youtube.com/watch?v=SB_0vRnkeOk
Maybe it's thermal camera...
 
@ircmaxell Any reason to not use phpdbg?
 
ThW
@webarto not that difficult - just use an Kinect
 
@bwoebi I'm not using it as a debugger
just have it installed
 
8:17 PM
@ThW OK, I'm living under a rock, thanks :)
 
ThW
:-P
 
@webarto Also failry easy to do with a simple camera and javascript :)
 
@ircmaxell oh noes, did someone write recursive code?
Don't you know that recursion is a bug?
 
@PeeHaa So Smart is not that smart :P
 
@NikiC no, it was "you would never want to var_dump a long string, so I'm going to trim it for you"
 
8:18 PM
@ircmaxell ah yeah, that one is also familiar ^^
 
@webarto I think I have seen @rlemon create something which uses camera input and renders ascii output based on that
@rlemon @rlemon @rlemon
 
Yeah, possible, just not sure about JS :P
Visual Basic 6 ftw
 
god you suck :P
 
yes, yes I have
I have also captured camera input and outputted it to the console.
and the favicon
 
Do you still have that linxzor?
 
8:20 PM
I can find em, which do you want?
 
That console thing
What is that favicon thing?
 
let me find em
 
@ircmaxell oh, that shit. Error formatting and var_dump formatting really suck...
 
jsfiddle.net/rlemon/nE9k6/show ascii webcam @PeeHaa
 
@ircmaxell why do you even have it installed?
 
8:23 PM
#ifndef PHP_recki180418325211362721015989040931843473544_H
#define PHP_recki180418325211362721015989040931843473544_H 1
#define PHP_recki180418325211362721015989040931843473544_VERSION "1.0"
#define PHP_recki180418325211362721015989040931843473544_EXTNAME "recki180418325211362721015989040931843473544"
extern zend_module_entry recki180418325211362721015989040931843473544_module_entry;
PHP_MINFO_FUNCTION(recki180418325211362721015989040931843473544);
#endif
@bwoebi I have usages...
 
Hm ok, thanks for your answer! I think I will do it with timestamp! Because I thought that I installed the latest mysql version
 
@ircmaxell ... like?
 
#include "php_recki180418325211362721015989040931843473544.h"
#include "php.h"
PHP_FUNCTION(test);
static long recki_if_test(long var1, int *validReturn){
long var10;
long var8;
zend_bool var6;
zend_bool var5;
long var3;
var3= 0;
label1:
var5=var3<10;
var6= !var5;
if (!var6) { goto label2; }
label3:
var8=var1+1;
*validReturn = SUCCESS;
return var8;
label2:
var10=var1+1;
var1= var10;
label4:
var3=var3+1;
goto label1;

}
PHP_FUNCTION(test) {
long reckiretval;
int validReturn;
long var1;
if (zend_parse_paramters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &var1) == FAILURE) {return;}
 
hm. looks definitely human-readable. Just not understandable.
 
@PeeHaa console webcam jsfiddle.net/rlemon/t6GT4
 
8:24 PM
@rlemon awesomesauce :D
 
@bwoebi I have newlines in there for my current usages...
 
@rlemon tnx
 
can't find the fav icon one
but basically you just capture the video, render to canvas, grab the data url, apply to the <link> in the header
easy peasy
 
@rlemon Witchcraft!
 
8:27 PM
I wish it wasn't so jittery
damn console.clear
 
@rlemon Yeah that is pretty sucky :(
 
@ircmaxell I really wonder if we don't already have such a PHP-to-C transpiler…
 
not animated version. just takes image inputs
 
Actually can't think of any... Anyway good work @ircmaxell
 
and the res variable is wonky
 
8:29 PM
ty
 
we can call it a lemon script
 
(tm)
 
thanks :-D
 
@ircmaxell might you test if gcc can optimize your code further than what you already have with jitfu?
 
it will, I can be sure of that :-)
 
8:32 PM
sure, but by what order of magnitude?
 
that's another story
 
My second awesome discovery of today: vipe
(pipeable vi) like... echo foo| vipe | grep bar, you get to edit between pipes
 
Mind....
blown
 
@ircmaxell Also, I haven't forgotten the references thing, just being busy with phpdbg currently.
 
brew|apt-get|yum install moreutils
 
8:37 PM
brew??? Get out of my sight
 
sponge is also kinda cool
 
@Leigh brew? on os x I usually compile any tools I need from scratch.
 
@bwoebi I can't be fucked wrestling with OSX, how am I supposed to watch videos and browse hacker news if I have to fix some broken compile
 
@Leigh Why should a compile be broken on os x?
 
@bwoebi no problem, :-)
Anyone see any problem with this config.m4?
        AC_MSG_CHECKING([Checking for supported PHP versions])
        PHP_recki1_FOUND_VERSION=`${PHP_CONFIG} --version`
        PHP_recki1_FOUND_VERNUM=`echo "${PHP_recki1_FOUND_VERSION}" | $AWK 'BEGIN { FS = "."; } { printf "%d", ([$]1 * 100 + [$]2) * 100 + [$]3;}'`
        if test "$PHP_recki1_FOUND_VERNUM" -lt "50300"; then
            AC_MSG_ERROR([not supported. Need a PHP version >= 5.3.0 (found $PHP_recki1_FOUND_VERSION)])
        else
            AC_MSG_RESULT([supported ($PHP_recki1_FOUND_VERSION)])
it phpize's just fine, it just doesn't actually build anything
(make returns imediately after making no targets)
 
8:48 PM
That config.m4 looks fine to me.
 
@bwoebi why does brew exist.
 
no idea.
 
@PeeHaa last time I put linux on my macbook it broke, work forces me to use macbook, lose/lose
 
@Leigh Unless you have to develop for mac / ios there is no reason ever to install mac software imo :)
 
@PeeHaa the thing I hate most, is the built-in openssh not supporting elliptic curve
 
8:52 PM
interesting, it's under a .NOEXPORT in the make file
 
how am I supposed to administer my servers from work, I really have to boot a VM to ssh from?....
 
@Leigh hehehe that sucks :P
 
@Leigh why would work force you to use a macbook?
 
user image
12
 
You can see that edit ;)
 
8:56 PM
@Leigh :P
Install windows on the thing to fuck with him/her :)
 
anybody can help laravel noob?
I installed composer on my web server and installed laravel with all dependencies so the files are there but when I open it in browser it loads webserver default page
 
this is really weird
@NikiC any obvious reason this wouldn't have a compiler target? gist.github.com/ircmaxell/a82ada13915224ddb66d
 
@salathe well, it's a trend now
 
@salathe Commit it to php-web as another logo please :)
 
@PeeHaa Haha, yes!
 
9:00 PM
@Leigh that's why you can just recompile it…
 
@ircmaxell compiler target?
 
make does nothing
 
but you ran phpize/buildconf and configure right?
 
@DušanRadojević That sounds like a webservice problem rather than a laravel problem
 
phpize && ./configure
 
9:01 PM
Have you restarted the thing?
 
PHP_PECL_EXTENSION = recki1
PHP_MODULES =
PHP_ZEND_EX =
all_targets = $(PHP_MODULES) $(PHP_ZEND_EX)
I wonder if it's because I'm not doing the PHP_ARG_ENABLE
 
@PeeHaa yes I tried :)
 
@ircmaxell no idea. I don't really know ac
 
@salathe where do you have that img from? If it's yours, just post it somewhere on /r/ (I doubt it's good enough for hn)
 
If the webservice gives you the default page and you have correctly restarted the webservice it means you have pointed it to the wrong directory
 
9:03 PM
yup, that was it
 
@bwoebi well I do, but I get brew to do it for me, because it's not happy out-of-the-box
 
@Leigh yeah, you have to make attention to not mix up the shared libraries...
 
like I said, fixing OSX shortcomings eats into valuable nerf-gun time
 
@ircmaxell ... I thought PHP_ARG_ENABLE was only to check for configure flags?!
 
it compiled when I did that
 
9:05 PM
@Leigh when you have done it a few times, it's not time-expensive anymore.
 
weird, this is really weird
it compiled a .la file, but no .so file
 
is it possible to serve laravel only for specific domain/subdomain is it in conflict with my apache?
Since: php artisan serve gives me that port 8000 is already taken
 
@ircmaxell isn't the .so file in .libs directory?
 
nope
a .la and a .lai
 
what's the Makefile you get?
 
9:11 PM
i's long
 
?
yeah, should be about 190 lines
 
185
this is really weird
 
Can't you dump it in a gist/pastebin?
 
@ircmaxell fyi it works for me, I get a .so
just from phpize && ./configure && make
(after having added an ARG_ENABLE)
 
9:22 PM
dat offer
 
ls .libs/
recki1.la      recki1.lai     recki1.o       recki1.so      recki1.so.dSYM
 
weird
I compiled github.com/krakjoe/ohash so it's not completely my machine
wait a sec
 
already tried to reclone and recompile?
 
SCREW YOU SUBLIME
 
what happened?
 
9:25 PM
@ircmaxell I have never seen Michael Dowling cede an argument, by the way.
He's not in-your-face arrogant, but he's quite proud and stubborn.
At least online.
 
@bwoebi it hid the ".so" file from me
 
lol ^
 
@LeviMorrison I'm not going further. I said my point, and the rest can remain
it wasn't compiling to a .so before, at one point it definitely was failing
 
@ircmaxell only trust the terminal, programs always lie to you ;-D
 
PHP Warning: PHP Startup: Unable to load dynamic library '~/workspace/ReckiCT-Live/ext/modules/recki3290766637728880465779426231415596187‌​.so' - /~/workspace/ReckiCT-Live/ext/modules/recki3290766637728880465779426231415596187‌​.so: undefined symbol: zend_parse_paramters in Unknown on line 0
head-desk
 
9:30 PM
@ircmaxell E_TYPO?
 
@PeeHaa yep
 
whoops
 
:P
 
Don't worry; I can't parse paramters either
 
:)
 
9:31 PM
PHP Warning: PHP Startup: Invalid library (maybe not a PHP library) 'ext/modules/recki4678925893285224114837067231680757847.so
well, that got better...
 
So after the announcement of PHP "7", Microsoft have announced Windows "10".
THEY STOLE OUR BIT!
 
38 mins ago, by salathe
user image
 
Yes, that
Dyscalculia is difficulty in learning or comprehending arithmetic, such as difficulty in understanding numbers, learning how to manipulate numbers, and learning facts in Mathematics. It is generally seen as a specific developmental disorder like dyslexia. Dyscalculia can occur in people from across the whole IQ range, often, but not always, involving difficulties with time, measurement, and spatial reasoning. Estimates of the prevalence of dyscalculia range between 3 and 6% of the population. A quarter of children with dyscalculia have ADHD. Mathematical disabilities can occur as the result of...
 
@ircmaxell wait... no PHP_MINIT_FUNCTION()?
 
no, no #include config.h
woot!!!
it works
it really works
now, to test the performance
 
9:40 PM
@GordonM err, wait. Windows just uses base 9, while we really hopped over 6 :-D
 
Tripped over 6 is more like it.
 
@GordonM so, another synonym of lazy
 
@Leigh I'm not touching that with a 11-foot barge pole.
 
...said the actress to the bishop
 
I don't have an install of jitfu on this compiter, but I'm computing fibo(30) in 0.009703 seconds, which is 285 times faster than raw PHP
 
9:52 PM
@ircmaxell Sorry, I totally missed the start/point of this... are you using recki to codegen C here?
 
@DaveRandom yes
 
awesomesauce
 
Okay, did someone move April to after September? Because if they haven't then there's a Tetris movie in development.
 
9:55 PM
@DaveRandom yup, so you can generate a PECL extension from PHP code :-D
it's dirty as crap, because it's just POC today
 
So, like, zephir, only good?
 
well, sort-of, yes. I guess. Except it's PHP, not some new language
 
@ircmaxell I love the commit messages history :P
 
@ircmaxell something went wrong when committing lib/ReckiCT/Compiler/PECL/Module.php?
 
@bwoebi I will use it when I refactor, it's not used at all
I originally intended to have a module class, which would contain multiple functions
and I will refactor to that, but for now, :-D
 
9:58 PM
oh, because it looked like truncated...
 
yeah, no, that was just dumb on my part :-D
 
github.com/google/recki-ct/compare/… … hehe, super naming scheme :-D
 
yeah, I figured for a poc, that should work... also why I didn't want to have to type --enable-recki3032589723908673459867wq3967394672349670987
 
@ircmaxell well, you can enable them by default?
 
yeah, that's what I did
 
10:09 PM
ah, because you hadn't in the config.m4 in the gist.
 
yup
 
@bwoebi Isn't that totally useless?
As in, being equivalent to having just one mt_rand?
 
I added more so that the maximum entropy is greater
 
more mt_rand, less collisions?
 
yes, it could generate 9999, just like mt_rand() by itself
but it can also generate PHP_INT_MAX . PHP_INT_MAX . PHP_INT_MAX . PHP_INT_MAX
i'll eventually replace it
 
10:12 PM
yeah had a logic error there
@AndreaFaulds Your re2c version is annoying.
 
I just wanted a POC, and that I got... :-D
now to benchmark it :-D
 
@NikiC It's newer than yours? :)
 
@AndreaFaulds yes. we all use 0.13.5
 
Heh
@NikiC We should remove it from the repo anyway
@NikiC FWIW your re2c version is annoying ;)
 
10:30 PM
@AndreaFaulds no, yours is.
 
still, the problem is it's in the repo
the version no. difference being the only change is worrying
it's relying on deterministic compilation
 
11:14 PM
oh, it's not the only change
aaaa
 
ping @PeeHaa?
 
11:34 PM
@AndreaFaulds If the version number in the output were the only change I wouldn't care
But if it also changes 3000 more lines, that's annoying
I wanted to rename a function, but if it's a 3000 line diff instead of a 4 line diff, that doesn't feel worthwhile...
 
11:51 PM
hello guys could you check this please codereview.stackexchange.com/questions/64324/…
 

« first day (1445 days earlier)      last day (3503 days later) »