<html>
<head>
<title>Apache APR Test</title>
</head>
<body>
<?php
$pid = getmypid();
$socket_count = 0;
echo "<h3>Non-forked test:</h3>\n";
echo "This script is running as pid $pid <br>\n";
for ( $counter = 0; $counter <= 1000; $counter += 1) {
if (file_exists("/proc/$pid/fd/$counter")) {
$link_target = readlink("/proc/$pid/fd/$counter");
echo "$counter: $link_target";
if ($counter == 0) { echo " (STDIN)"; }
if ($counter == 1) { echo " (STDOUT)"; }
if ($counter == 2) { echo " (STDERR)"; }
if (preg_match("/^socket:/", $link_target)) {
$socket_count = $socket_count + 1;
}
echo "<br>\n";
}
}
if ($socket_count > 1) {
echo "<h2>THIS SERVER IS VULNERABLE (even without forking)</h2>\n";
} else {
echo "<h3>This server passes the non-forked test</h3>\n";
}
$socket_count = 0;
echo "<h3>Forking test:</h3>\n";
exec("perl -e 'print \"This script is running as pid \$\$<br>\\n\"; foreach (1..1000) {\$p=\"/proc/\$\$/fd/\$_\";if(-e \$p) { print \"\$_: \" . (readlink \$p) . \"\n\"; }}'", $results);
foreach ($results as $value) {
echo "$value<br>\n";
if (preg_match("/^\d+: socket:/", $value)) {
$socket_count = $socket_count + 1;
}
}
if ($socket_count > 1) {
echo "<h2>THIS SERVER IS VULNERABLE (with forking)</h2>\n";
} else {
echo "<h3>This server passes the forked test</h3>\n";
}
?>
</body>
</html>