-
Notifications
You must be signed in to change notification settings - Fork 1
/
nullbyteposen.php
115 lines (90 loc) · 2.59 KB
/
nullbyteposen.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
<?php
/**
* Usage: php -q <file>
*/
if(!function_exists('memory_get_usage')) {
function memory_get_usage() {
return -1;
}
}
if(PHP_SAPI != 'cli') {
die("Please run this script from command line");
}
$loops = 2000000;
$str = dirname(__FILE__);
$str .= "/../../../../../etc/passwd\0";
$str .= '/expr.php';
//echo realpath($str) . "\n\n";
//echo substr($str, (int)strpos($str, "\0")) . "\n\n";
//exit;
if($_SERVER['argc'] == 1) {
$secs = array();
$results = array();
echo 'Running bench:';
for($i = 0; $i <= 1; $i++) {
$cmd = $_SERVER[_] . ' ' . $_SERVER['SCRIPT_FILENAME'] . ' ' . $i;
$ret = unserialize(`$cmd`);
$secs[] = $ret[1];
$results[] = $ret;
echo '.';
}
echo 'done' . PHP_EOL;
} else {
switch ($_SERVER['argv'][1]) {
case '0':
$m = memory_get_usage();
$s = microtime(1);
for($i = 0; $i < $loops; $i++) {
$v = str_replace("\0", '', $str);
}
$return = array(
'str_replace(..., "", str)',
(microtime(1)-$s),
(memory_get_usage()-$m)
);
echo serialize($return);
break;
case '1':
$m = memory_get_usage();
$s = microtime(1);
for($i = 0; $i < $loops; $i++) {
$v = substr($str, (int)strpos($str, "\0"));
}
$return = array(
'substr(str, strpos(str ...))',
(microtime(1)-$s),
(memory_get_usage()-$m)
);
echo serialize($return);
break;
}
exit;
}
$php = PHP_VERSION;
$type = gettype($elem);
echo <<<head
benchmark for replacement of \\x0 (null byte poisen) in PHP v$php
+---------------------------------------------+-------+----------+---------+
| description | sec | memory | % |
+---------------------------------------------+-------+----------+---------+
head;
asort($secs);
$i = 0;
foreach ($secs as $k => $v) {
if($i == 0) {
$best = $results[$k][1];
$results[$k][3] = '100%';
} else {
$results[$k][3] = round(($results[$k][1] * 100) / $best) . '%';
}
echo sprintf(
"| %-43s | %-5s | %-8s | %-7s |\n+%'-45s+%'-7s+%'-10s+%'-9s+\n",
$results[$k][0],
round($results[$k][1],3),
$results[$k][2],
$results[$k][3],
'','','',''
);
$i++;
}
echo "\n\n";