78ResearchLab/PHP2Shell-Full-Chain-Exploit

选用指南

AI 根据 README 整理 · 2026/10/23 13:56:19

使用方式

通过命令行运行exploit.py进行漏洞验证，支持文件回显和盲注时间两种模式，并提供Docker环境搭建。

查看 README 依据

| `Docker/` | Vulnerable target environment (php:8.4.26-apache) | ### Verification Environment Setup ```bash cd Docker docker compose up -d --build ``` ### exploit.py ```bash # File-based oracle (writes output to webroot, reads it back) python3 exploit.py --host 127.0.0.1 --port 8088 \ --cmd 'id>/var/www/html/pwn.txt' --fetch /pwn.txt # Blind timing oracle (no webroot write required) python3 exploit.py --host 127.0.0.1 --port 8088 --sleep-oracle ``` Options: `--zif-offset`, `--dtor-offset`, `--r0-lo`, `--r0-hi`, `--r0-lowbits`, `--thorough` ### Attack Profile | | | |---|---|

部署要求

需要Docker和Python3环境，exploit.py默认针对php:8.4.26-apache镜像，需在隔离实验室中使用。

查看 README 依据

| `Docker/` | Vulnerable target environment (php:8.4.26-apache) | ### Verification Environment Setup ```bash cd Docker docker compose up -d --build ``` ### exploit.py ```bash # File-based oracle (writes output to webroot, reads it back) python3 exploit.py --host 127.0.0.1 --port 8088 \ --cmd 'id>/var/www/html/pwn.txt' --fetch /pwn.txt # Blind timing oracle (no webroot write required) python3 exploit.py --host 127.0.0.1 --port 8088 --sleep-oracle ``` Options: `--zif-offset`, `--dtor-offset`, `--r0-lo`, `--r0-hi`, `--r0-lowbits`, `--thorough` ### Attack Profile | | | |---|---|

- **`session.upload_progress.enabled`**: Must be `On` (default in most distributions). - **Offsets**: Build-specific (`--zif-offset`, `--dtor-offset`). Defaults target php:8.4.26-apache. - **`r0_offset`**: Runtime heap layout value, not in the binary. `exploit.py` brute-forces it automatically. ## Disclaimer This tool is provided for authorized security research and educational purposes only. Use only in isolated lab environments with explicit authorization.

已知限制

exploit.py仅适用于mod_php或lsphp SAPI，且需要单prefork worker和session.upload_progress.enabled为On；PHP-FPM下该exploit链不生效，但漏洞本身仍影响所有SAPI。

查看 README 依据

are all equally exposed. ### Exploitation Constraints > The constraints below apply to **this repository's exploit (`exploit.py`)**, not to the vulnerability itself. Environments that do not meet them are still vulnerable and must be patched. - **SAPI**: This exploit targets mod_php or lsphp. On PHP-FPM the worker is respawned on OOM, so this chain does not land — PHP-FPM is still affected per the official advisory. - **Worker count**: This exploit requires a single prefork worker for deterministic heap grooming.

- **`session.upload_progress.enabled`**: Must be `On` (default in most distributions). - **Offsets**: Build-specific (`--zif-offset`, `--dtor-offset`). Defaults target php:8.4.26-apache. - **`r0_offset`**: Runtime heap layout value, not in the binary. `exploit.py` brute-forces it automatically. ## Disclaimer This tool is provided for authorized security research and educational purposes only. Use only in isolated lab environments with explicit authorization.