Re: Arbitrary code execution in eping plugin

[Sam Michaels <samthecomputerman () gmail com>]

On 11 Jun 2005 20:15:09 -0000, oliver () codersquad de
<oliver () codersquad de> wrote:
> So only IP-Adresses are allowed and no kind of code injection is possible.

I'm unfamiliar with this particular program, so forgive me if I'm way
off base...however...give this a try:

function eping_validaddr($eping_hosttocheck)
{
  return ip2long($eping_hosttocheck);
}

On a failure, it will return (int)-1 or (bool)FALSE depending on your
PHP version.  Before doing the actual ping, you'll want to grab the
result of eping_validaddr() and run it through long2ip() as a final
step of validation.  Example:

$exploit = long2ip(ip2long('127.0.0.1;commands%20here'));

It will populate $exploit with (string)"255.255.255.255" (just
ip2long() alone on that returns -1 in PHP4 or FALSE in PHP5).

Sam