First of all, thanks to KillaBoi for his great work!
For days I was reading many threads saying that PHP2Shell is very hard to exploit, with no working public PoC available. Honestly, I patched my servers but had no way to verify if the patches actually worked. And ecently, reading the PoC from KillaBoi gave me the idea to make it easier to verify my servers, so I wanted to share it here with you: https://github.com/MartinPham/php2shell-poc
The exploit requires some specific information to work, like the PHP version, the binary's properties (how it was built, optimizations, etc.) and the runtime configuration. Yes, you can hide these from others, but anyone who knows the Docker image or PHP build can calculate the exact values needed to exploit your servers.
The repository contains:
- The Lab (compose.yml + lab/): a PHP/nginx setup to test against (nginx and PHP versions are not exposed to the client)
- poc.py: a single self-contained script that both calculates the needed values from a Docker image and runs the exploit against the target
I decided to make this public because others will find a way to exploit it anyway, so please patch your servers now.
评论
1 条预览评论 · 正在加载完整讨论请先登录 h4cker 账号，然后连接 Hacker News 后发表评论。
First of all, thanks to KillaBoi for his great work! For days I was reading many threads saying that PHP2Shell is very hard to exploit, with no working public PoC available. Honestly, I patched my servers but had no way to verify if the patches actually worked. And ecently, reading the PoC from KillaBoi gave me the idea to make it easier to verify my servers, so I wanted to share it here with you: https://github.com/MartinPham/php2shell-poc The exploit requires some specific information to work, like the PHP version, the binary's properties (how it was built, optimizations, etc.) and the runtime configuration. Yes, you can hide these from others, but anyone who knows the Docker image or PHP build can calculate the exact values needed to exploit your servers. The repository contains: - The Lab (compose.yml + lab/): a PHP/nginx setup to test against (nginx and PHP versions are not exposed to the client) - poc.py: a single self-contained script that both calculates the needed values from a Docker image and runs the exploit against the target I decided to make this public because others will find a way to exploit it anyway, so please patch your servers now.