PHP: eval() of a XOR between two strings via the URL parameter

user_7211484 0
Viewed 260

In PHP, the XOR between 2 strings is done by xoring the ascii value of each couple of characters. For instance I can write "_<(0[|@>2__[@"^":_@_{[([^30|{" instead of "echo 'hello';".

If I run this PHP <?php eval("_<(0[|@>2__[@"^":_@_{[([^30|{");, it prints hello on the page. (example in a sandbox)

I tried to eval that XOR in a URL parameter using the following code running locally at localhost:8000 but it doesn't print anything.

<?php
    if(isset($_GET['param'])){
        eval($_GET['param']);
        die();
    }

The request URL I wrote is:

http://localhost:8000/?param="_<(0[|@>2__[@"^":_@_{[([^30|{"

My question is why the xor between the strings in the URL parameter is not evaluated. How can I make it working?

php
1 Answers

If you turn errors on in your PHP installation, you would see the following error:

Parse error: syntax error, unexpected end of file in ... : eval()'d code on line 1

Now, on further inspection of the error, I found that eval() requires statements and not expressions. See: Unexpected $end in eval()'d code

Since your argument to eval does not contain a statement rather an expression "_<(0[|@>2__[@"^":_@_{[([^30|{", it fails.

As @Progman suggested in his comment, instead of using:

eval($_GET['param']);

Use the following:

eval('eval('.$_GET['param'].");");
user_18878540
Related