ikow/php2shell-poc

选用指南

AI 根据 README 整理 · 2026/10/22 11:46:48

目标用户

面向进行授权安全测试的研究人员。

查看 README 依据

This research is for authorized security testing and educational purposes only. Do not use against systems you do not own or have explicit authorization to test. ## License MIT

使用方式

通过命令行运行POC脚本，并使用Docker搭建实验环境。

查看 README 依据

verify_handler_mismatch.py — Verify handler mismatch → object deserialization lab/ docker-compose.yml — PHP 8.2.34 FPM + nginx lab environment Dockerfile — Vulnerable PHP build php.ini — Lab configuration setup.sh — One-click lab setup docs/ ANALYSIS.md — Full technical analysis ``` ## Quick Start ```bash # Start the lab cd lab && ./setup.sh # Verify session injection python3 poc/verify_session_injection.py --target http://127.0.0.1:18080 # Verify UAF (requires ASAN build)

docker exec php-asan-lab php poc/verify_uaf_asan.php # Verify handler mismatch python3 poc/verify_handler_mismatch.py --target http://127.0.0.1:18080 ``` ## Affected Versions - PHP 5.4.0 — 8.5.11 (all versions with `session.upload_progress`) - Fixed in: 8.2.35, 8.3.36, 8.4.27, 8.5.12 (scheduled 2026-10-21) - PHP 5.x, 7.x, 8.0, 8.1: **end-of-life, no official fix** ## Mitigation ```ini ; Immediate mitigation (does NOT fix all attack paths) session.upload_progress.enabled = Off session.use_only_cookies = On ``` ## Disclaimer

部署要求

需要Python 3和Docker，以及ASAN构建用于UAF验证。

查看 README 依据

verify_handler_mismatch.py — Verify handler mismatch → object deserialization lab/ docker-compose.yml — PHP 8.2.34 FPM + nginx lab environment Dockerfile — Vulnerable PHP build php.ini — Lab configuration setup.sh — One-click lab setup docs/ ANALYSIS.md — Full technical analysis ``` ## Quick Start ```bash # Start the lab cd lab && ./setup.sh # Verify session injection python3 poc/verify_session_injection.py --target http://127.0.0.1:18080 # Verify UAF (requires ASAN build)

docker exec php-asan-lab php poc/verify_uaf_asan.php # Verify handler mismatch python3 poc/verify_handler_mismatch.py --target http://127.0.0.1:18080 ``` ## Affected Versions - PHP 5.4.0 — 8.5.11 (all versions with `session.upload_progress`) - Fixed in: 8.2.35, 8.3.36, 8.4.27, 8.5.12 (scheduled 2026-10-21) - PHP 5.x, 7.x, 8.0, 8.1: **end-of-life, no official fix** ## Mitigation ```ini ; Immediate mitigation (does NOT fix all attack paths) session.upload_progress.enabled = Off session.use_only_cookies = On ``` ## Disclaimer

已知限制

作者明确说明仅用于授权测试和教育目的，且缓解措施不能修复所有攻击路径。

查看 README 依据

This research is for authorized security testing and educational purposes only. Do not use against systems you do not own or have explicit authorization to test. ## License MIT

docker exec php-asan-lab php poc/verify_uaf_asan.php # Verify handler mismatch python3 poc/verify_handler_mismatch.py --target http://127.0.0.1:18080 ``` ## Affected Versions - PHP 5.4.0 — 8.5.11 (all versions with `session.upload_progress`) - Fixed in: 8.2.35, 8.3.36, 8.4.27, 8.5.12 (scheduled 2026-10-21) - PHP 5.x, 7.x, 8.0, 8.1: **end-of-life, no official fix** ## Mitigation ```ini ; Immediate mitigation (does NOT fix all attack paths) session.upload_progress.enabled = Off session.use_only_cookies = On ``` ## Disclaimer