# PHP Disable Functions Bypass

> How to test for PHP disable_functions and safe_mode bypass vulnerabilities during authorized penetration testing. Use this skill whenever you need to assess PHP security configurations, test for function restriction bypasses, or evaluate PHP hardening effectiveness. Make sure to use this skill when the user mentions PHP security testing, disable_functions bypass, safe_mode testing, PHP vulnerability assessment, or web application security audits involving PHP.

- Skill: `abelrguezr/php-disable-functions-bypass-4` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/php-disable-functions-bypass-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/php-disable-functions-bypass-4/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/abelrguezr/php-disable-functions-bypass-4

---


# PHP disable_functions and safe_mode Bypass Testing

## Purpose

This skill helps security professionals test for PHP configuration bypass vulnerabilities during **authorized penetration testing engagements only**. Understanding these bypass techniques is essential for:

- Assessing PHP hardening effectiveness
- Identifying misconfigurations in production systems
- Validating security controls
- Remediation guidance

## Authorization Requirements

**CRITICAL**: Only use these techniques on systems where you have:
- Written authorization from the system owner
- A valid penetration testing engagement
- Proper scope documentation

Unauthorized testing is illegal and unethical.

## Vulnerability Overview

PHP's `disable_functions` and `safe_mode` settings are designed to restrict dangerous function calls. However, certain PHP extensions can bypass these restrictions:

### The Bypass Mechanism

1. **disable_functions**: Blocks specific PHP functions (e.g., `system()`, `exec()`, `shell_exec()`)
2. **safe_mode**: Restricts file access and function execution (deprecated in PHP 5.4, removed in 7.0)
3. **Extension bypass**: Some extensions like `win32std` on Windows can execute system commands without going through the disabled function checks

### Affected Versions

- PHP 5.2.x (particularly 5.2.3)
- Windows environments with `win32std` extension
- Other extensions may have similar issues on different platforms

## Testing Methodology

### Step 1: Information Gathering

Check PHP configuration:

```php
<?php
phpinfo();
?>
```

Look for:
- `disable_functions` value
- `safe_mode` status
- Loaded extensions (especially `win32std`, `com_dotnet`, `php_intl`)

### Step 2: Verify Restrictions

Test if functions are actually disabled:

```php
<?php
$test_functions = ['system', 'exec', 'shell_exec', 'passthru', 'proc_open'];
foreach ($test_functions as $func) {
    if (function_exists($func)) {
        echo "$func: EXISTS\n";
    } else {
        echo "$func: DISABLED\n";
    }
}
?>
```

### Step 3: Check for Bypass Extensions

Identify potentially dangerous extensions:

```php
<?php
$dangerous_extensions = [
    'win32std' => 'Windows shell execution',
    'com_dotnet' => 'COM/.NET execution',
    'php_intl' => 'Internationalization (may have RCE)',
    'suhosin' => 'Security extension (can be bypassed)'
];

foreach ($dangerous_extensions as $ext => $desc) {
    if (extension_loaded($ext)) {
        echo "⚠️ $ext loaded: $desc\n";
    }
}
?>
```

### Step 4: Test Bypass Vectors

**Only in authorized test environments:**

#### win32std Extension (Windows)

If `win32std` is loaded, it may bypass `disable_functions`:

```php
<?php
if (extension_loaded('win32std')) {
    echo "win32std extension detected - potential bypass available\n";
    // Document this finding - do not execute in production
}
?>
```

#### COM Extension (Windows)

```php
<?php
if (extension_loaded('com_dotnet')) {
    echo "com_dotnet extension detected - potential bypass available\n";
}
?>
```

#### php_intl Extension

```php
<?php
if (extension_loaded('intl')) {
    echo "intl extension detected - check for ICU RCE vulnerabilities\n";
}
?>
```

## Detection Indicators

### Signs of Vulnerability

1. `disable_functions` is set but dangerous extensions are loaded
2. `safe_mode` is enabled on PHP < 5.4
3. Windows environment with `win32std` extension
4. Function restrictions don't match actual behavior

### Log Analysis

Check for:
- Unexpected process spawns (cmd.exe, powershell.exe)
- PHP errors mentioning disabled functions
- Extension loading messages

## Remediation

### Immediate Actions

1. **Disable dangerous extensions** in php.ini:
   ```ini
   ;extension=php_win32std.dll
   ;extension=php_com_dotnet.dll
   ```

2. **Upgrade PHP** to a supported version (7.4+ or 8.x)

3. **Remove safe_mode** (deprecated) and use proper alternatives:
   - Open_basedir restrictions
   - SELinux/AppArmor policies
   - Containerization

### Long-term Hardening

1. **Principle of least privilege**: Run PHP as non-root user
2. **Disable unnecessary extensions**: Audit and remove unused extensions
3. **Use modern PHP versions**: PHP 5.x is end-of-life
4. **Implement WAF**: Web Application Firewall for additional protection
5. **Regular security audits**: Periodic penetration testing

## Reporting

When documenting findings:

1. **Severity**: High (allows command execution despite restrictions)
2. **CVSS Factors**: 
   - Attack Vector: Network
   - Attack Complexity: Low
   - Privileges Required: None
   - Impact: Complete system compromise
3. **Evidence**: Screenshots of phpinfo, extension list, test results
4. **Remediation**: Specific steps from above

## Legal Disclaimer

This skill is for **authorized security testing only**. Unauthorized access to computer systems is illegal under laws including:
- Computer Fraud and Abuse Act (CFAA) - USA
- Computer Misuse Act - UK
- Similar laws in other jurisdictions

Always obtain written authorization before testing.

## References

- [PHP disable_functions documentation](https://www.php.net/manual/en/ini.core.php#ini.disable-functions)
- [PHP safe_mode (deprecated)](https://www.php.net/manual/en/ini.core.php#ini.safe-mode)
- [OWASP PHP Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/PHP_Configuration_Cheat_Sheet.html)
- [PHP Extension Security Guide](https://www.php.net/manual/en/security.php)