php-bytecode-security-framework

A high-level Python API for converting PHP files into a PHP Bytecode Pydantic model. It incorporates additional functions to assist in the analysis of PHP bytecode. The implementation involves a Python module written in C to convert PHP source files to Zend bytecode (op_arrays) Python objects.

Why php-bytecode-security-framework

Please visit https://finixbit.github.io/posts/autonomous-Hacking-of-PHP-Web-Applications-at-the-Bytecode-Level/

Requirements

Docker - Build, test, and deploy applications quickly.

Setting up

git clone https://github.com/finixbit/php-bytecode-security-framework
cd php-bytecode-security-framework
docker run --rm -it --entrypoint /bin/bash -v ${PWD}/:/app debian:buster-20220801
cd /app
./setup_scripts/install_deps.sh
./setup_scripts/install_framework.sh

Example Test cases

Before running any of the test cases below, you need to set the docker container by following the setup above

Testing with Vulnerable Web Applications

All tests were done with detection_script/simple_code_injection.py which only models generic PHP global variables (SOURCES) like $_GET, $_POST, $_REQUEST and traces data down to potentially vulnerable calls (SINKS) like echo, concat, include, require, cast, etc.

Name	Vulns	Report	Github
Damn Vulnerable Web Application (DVWA)	21	Report Link	Github Repo
OWASP Vulnerable Web Application Project	10	Report Link	Github Repo
Simple SQL Injection Training App	15	Report Link	Github Repo
Vulnerable Web application made with PHP/SQL	6	Report Link	Github Repo
InsecureTrust_Bank - Educational repo demonstrating web app vulnerabilities	5	Report Link	Github Repo

Projects

php_bytecode_api (src/php_bytecode_api)

A high-level Python API for src/php_to_bytecode_converter, intended for the conversion of PHP files into a defined PHP Bytecode Pydantic model. This includes additional functions to facilitate the analysis of PHP bytecode.

importphp_bytecode_apifunctions: list[FunctionModel] =php_bytecode_api.convert_and_lift(path_to_php_file)

See Pydantic Models below for more details on the data structure FunctionModel extracted from the PHP Bytecode.

php_to_bytecode_converter (src/php_to_bytecode_converter)

A Python module is written in C to convert PHP source files to Zend bytecode (op_arrays), CFG, DFG, and SSA Python objects.

importphp_to_bytecode_converterfunctions: list[dict] =php_to_bytecode_converter.convert(path_to_php_file)

Below is the data structure extracted from each function found in a PHP file:

- filename: str
- class_name: str
- function_name: str
- num_args: int
- required_num_args: int
- number_of_instructions: int
- extra = {type: intnumber_of_cv_variables: int number_of_tmp_variables: intlast_live_range: intlast_try_catch: int arg_flags: list [int, int, int]last_literal: intliterals: [{type: strvalue: str}]}
- instructions = [{op1: {type: strvalue: strvariable_number: int}op2: {type: strvalue: strvariable_number: int}result: {type: strvalue: strvariable_number: int}num: intextended_value: intlineno: intopcode: intopcode_name: stropcode_flags: intop1_type: intop2_type: intresult_type: int}]
- cfg = {blocks_count: intedges_count: intblocks: [{start: intlen: intsuccessors_count: intpredecessors_count: intpredecessor_offset: intidom: intloop_header: intlevel: intchildren: intnext_child: intsuccessors_storage: [int, int]successors: [int, int]}]predecessors: [int, int]}
- dfg = [{block_index: intvar_def: [{var_num: intvar_name: str}]var_use: [{var_num: intvar_name: str}]var_in: [{var_num: intvar_name: str}]var_out: [{var_num: intvar_name: str}]var_tmp: [{var_num: intvar_name: str}]}]
- ssa = {number_of_sccs: intnumber_of_ssa_variables: intssa_variables: [{ssa_var_num: intvar_num: intvar_name: strdefinition: intdefinition_phi: {pi: intvariable_index: intvariable: {var_num: intvar_name: str}ssa_variable_index: intcurrent_block_index: intvisited: inthas_range_constraint: intconstraint: {range_range_min: intrange_range_max: intrange_range_underflow: intrange_range_overflow: intrange_min_var: intrange_max_var: intrange_min_ssa_var: intrange_max_ssa_var: int}sources: [...int]}no_val: intuse_chain: intescape_state: intstrongly_connected_component: intstrongly_connected_component_entry: int}]ssa_instructions: [{op1_use: intop2_use: intresult_use: intop1_def: intop2_def: intresult_def: intop1_use_chain: intop2_use_chain: intres_use_chain: int}]ssa_blocks: [{block_index; intphis; [{pi: intvariable_index: intvariable: {var_num: intvar_name: str}ssa_variable_index: intcurrent_block_index: intvisited: inthas_range_constraint: intconstraint: {range_range_min: intrange_range_max: intrange_range_underflow: intrange_range_overflow: intrange_min_var: intrange_max_var: intrange_min_ssa_var: intrange_max_ssa_var: int}sources: [...int]}]}]}

detectors

Directory to hold all scripts

• detectors/template_script.py - template script to get started.
• detectors/code_injection.py - Models generic PHP global variable (SOURCES) like $_GET, $_POST, $_REQUEST and traces data down to potentially vulnerable calls (SINKS) like echo, concat, include, etc.

targets

Directory to store target source files. Follow the Example Test Cases above to set up a target.