syhunt/php2shell-protection

选用指南

AI 根据 README 整理 · 2026/10/22 03:56:22

使用方式

通过浏览器访问checkblock.php或testblock.php进行测试，需将文件上传至Apache服务器并配置.htaccess规则。

查看 README 依据

- `testblock.php`: standalone, browser-based multipart POST test (no cURL required). ## Requirements - PHP 5.2 or newer with the cURL extension enabled. - Apache with `mod_rewrite` enabled and `.htaccess` rewrite overrides permitted. - Server-side HTTP(S) requests to the selected hostname must work. ## Usage 1. Select **either** `http/` or `https/` depending on how your server can reach itself. Do not deploy both to the same directory. 2. Upload `target.php` and `checkblock.php` into a temporary web-accessible test directory.

3. Add the example rewrite rule and request-body limit to the appropriate existing `.htaccess` (or create one). If your site already has redirects, place the blocking rule **before** them. Preserve your existing rules. Note that nested `.htaccess` files and virtual-host configuration can change the effective behavior. 4. Open `checkblock.php` in your browser. It makes two small POST requests to `target.php` using the selected scheme. `CURLOPT_FOLLOWLOCATION` is disabled so redirects remain visible.

`testblock.php` is an alternative to the cURL-based `checkblock.php` tests. It works with **PHP 5.2+**, requires **no cURL extension**, and sends a real `multipart/form-data` POST from your browser to itself. The form uses a hidden text field rather than a file upload, demonstrating that the block applies to multipart forms even when no file is attached.

部署要求

需要PHP 5.2或更高版本（checkblock.php需cURL扩展，testblock.php不需要），Apache需启用mod_rewrite并允许.htaccess覆盖。

查看 README 依据

- `testblock.php`: standalone, browser-based multipart POST test (no cURL required). ## Requirements - PHP 5.2 or newer with the cURL extension enabled. - Apache with `mod_rewrite` enabled and `.htaccess` rewrite overrides permitted. - Server-side HTTP(S) requests to the selected hostname must work. ## Usage 1. Select **either** `http/` or `https/` depending on how your server can reach itself. Do not deploy both to the same directory. 2. Upload `target.php` and `checkblock.php` into a temporary web-accessible test directory.

`testblock.php` is an alternative to the cURL-based `checkblock.php` tests. It works with **PHP 5.2+**, requires **no cURL extension**, and sends a real `multipart/form-data` POST from your browser to itself. The form uses a hidden text field rather than a file upload, demonstrating that the block applies to multipart forms even when no file is attached.

已知限制

该工具不是漏洞扫描器，不能证明服务器对任一CVE完全安全；仅测试特定请求路径，不覆盖其他方法、虚拟主机或绕过路由。

查看 README 依据

The test outcome **403 / PHP not executed** verifies only the tested request path. It is **not** a vulnerability scanner, does not exercise either exploit, and cannot certify that a server is safe from either CVE. ### PHP configuration and PHP 5.2 compatibility Where supported (PHP 5.4+), the upload-progress setting can be disabled in the effective `php.ini` or an appropriate server/FPM configuration **before request parsing**, followed by a restart of every relevant worker: ```ini session.upload_progress.enabled = 0 ```

A 403 indicates that the tested request was rejected, but does not by itself prove which component rejected it. This is a **functional configuration test**, not a vulnerability scanner or proof of complete protection from either PHP CVE. It does not test alternate methods, malformed headers, other virtual hosts, or routes that bypass the rule. For vulnerabilities in the PHP runtime, upgrading to a supported patched PHP release remains essential. PHP 5.2 is end-of-life. ## License This project is distributed under the [MIT License](LICENSE). ## Credits