devploit/php2shell

选用指南

AI 根据 README 整理 · 2026/10/22 21:57:03

适用场景

适用于对授权系统进行安全测试，在隔离环境中复现和验证特定 PHP 版本的 RCE 漏洞。

查看 README 依据

# PHP2Shell **Pre-auth RCE research toolkit for CVE-2026-109618 / CVE-2026-109619** `exploit by devploit`  *Verified run against the local PHP 8.5.11 laboratory: `uid=33(www-data)`.* > **Authorized testing only.** Use this material exclusively against systems you > own or have explicit, written permission to test. It is not a scanning tool, > it ships no target list, and it must not be used against third-party > infrastructure. The chain is disruptive: it sends large request bodies,

> triggers pre-RINIT out-of-memory conditions and kills Apache children. PHP2Shell is a research workspace for the `session.upload_progress` OOM / stale-pointer chain in PHP's Apache module. It packages a version-aware dispatcher, a per-build profile engine, reproducible laboratories, a calibration factory and runtime instrumentation around the public research exploit by [9bie](https://github.com/9bie/php2shell-bypass-aslr-exp). The goal is reproducible research and defensive validation, not mass exploitation. The dispatcher refuses to guess: it stops when the build has no

使用方式

通过命令行工具使用，如 php2shell_auto.py 运行自动化调度器，php2shell_labs.py 启动本地实验环境。

查看 README 依据

Requirements: Python 3.11+, Docker (for the labs), Linux or macOS on arm64 or amd64. Fetch the pinned upstream: ```sh python3 tools/bootstrap_upstream.py ``` The script clones the public 9bie research into `vendor/php2shell-upstream` and checks out the pinned commit. The toolkit applies the minimal SNI and heap-parameter changes in place at runtime; they are documented in [docs/upstream-changes.md](docs/upstream-changes.md). No patch file is redistributed. Start the local laboratories and run the dispatcher against the PHP 8.4.26 lab: ```sh python3 tools/php2shell_labs.py up

python3 tools/php2shell_auto.py \ -u http://127.0.0.1:8105/index.php \ --container p2s-lab-8426 \ --repo-dir vendor/php2shell-upstream ``` Expected shape: ```text exploit by devploit · CVE-2026-109618 / CVE-2026-109619 automatic target detection, build profile dispatch and command execution authorized testing only [*] CHAIN 01/01 automatic target detection / fixed command proof 00:00.00 DISCOVER http://127.0.0.1:8105/index.php 00:00.01 OK PHP 8.4.26 · Apache/2.4.69 (Debian) 00:00.01 PREFLIGHT php-8.4.26-bookworm-amd64

部署要求

需要 Python 3.11+、Docker 以及 Linux 或 macOS 系统，支持 arm64 和 amd64 架构。

查看 README 依据

Requirements: Python 3.11+, Docker (for the labs), Linux or macOS on arm64 or amd64. Fetch the pinned upstream: ```sh python3 tools/bootstrap_upstream.py ``` The script clones the public 9bie research into `vendor/php2shell-upstream` and checks out the pinned commit. The toolkit applies the minimal SNI and heap-parameter changes in place at runtime; they are documented in [docs/upstream-changes.md](docs/upstream-changes.md). No patch file is redistributed. Start the local laboratories and run the dispatcher against the PHP 8.4.26 lab: ```sh python3 tools/php2shell_labs.py up

已知限制

仅支持 mod_php prefork 模式，不支持 FPM；需要单 worker 或使用 pinning；display_errors=Off 时未提供完整的 stage-1 泄漏；HTTPS 传输为实验性。

查看 README 依据

- **Reduce worker state reuse.** Keep session state per application and avoid sharing session storage across trust boundaries. - **Detect.** Watch for multipart requests with ~1000 fields, very large bodies, repeated OOM/500 responses, Apache child crashes and `zend_mm_heap corrupted` log lines. Rate-limit large multipart bodies at the edge. - **Least privilege.** Run PHP as an unprivileged user with a read-only document root and no shell access where possible. ## Limitations - **mod_php prefork only.** PHP-FPM has a different lifecycle; the chain does

not transfer as-is and FPM is not supported. - **One worker / pinning.** Without pinning, the per-worker session state breaks stage 1. - **Per-build offsets.** A profile is tied to a `libphp.so` build; the same version from another distribution or architecture needs its own offsets and heap calibration. - **`display_errors=Off` is not complete.** The OOM-in-cookie primitive is reproducible in research, but the stage-1 leak is not shipped for that configuration. - **`expose_php=Off` changes stage 3.** Hiding `X-Powered-By` shifts the startup