Interesting, can you give some more info?
The best path forward I found was using 9bie/php2shell-bypass-aslr-exp and figuring out how to shrink the B1 leak down to >1.21MiB
fyi for anyone who heard that there isn't a php2shell poc that works on a default server configuration that isn't true 9bie/php2shell-bypass-aslr-exp
`python3 exploit.py --port 18110 --workers 150` gets rce on `podman run --rm -it -p 127.0.0.1:18110:80 -v ./docker/www […]
4 likes · 3 reposts
Did some more digging into the publicly available RCE exploits for #php2shell and the results look pretty sobering:
The arguably most promising one is 9bie's (9bie/php2shell-bypass-aslr-exp), which I spent some time looking at.
TL;DR: It works, but only under very controlled […]
4 reposts
@LiveOverflow Already there in labs, is also handled in similar way on 9bie/php2shell-bypass-aslr-exp and TheCyberGeek/php2shell-research . The problem that you need to address on that in reality is the additional user/ normal operation. Ideally you will need to consume all workers and release 1.
10 likes · 1,020 views
12h before your comment the difficult part a random AI prompt was unlikely to find already dropped on github 9bie/php2shell-bypass-aslr-exp
[Project] I translated the full PHP 8.4.26 HTTP-only RCE research repository into English, including technical documentation and code comments
I recently came across 9bie's php2shell research, which demonstrates an HTTP-only RCE exploit chain against PHP 8.4.26, including an ASLR bypass, under the official production configuration.
While the original repository already provides an English README, much of the detailed research documentation and code commentary is written in Chinese.
To make the research more accessible to the international security community, I put together an English-translated version of the repository, covering the technical documentation and code comments while preserving the original implementation and project structure.
For context, the original research demonstrates:
- Remote code execution using HTTP requests only.
- An ASLR bypass using out-of-bounds memory disclosure.
- Exploitation without enabling display_errors or modifying the default 128 MB memory limit.
- A multi-stage exploitation chain involving PHP session-state corruption, heap manipulation, and control-flow hijacking.
- Successful reproduction under the official Apache prefork configuration, with a reported 10/10 success rate in the tested environment.
The repository also contains extensive technical notes covering the development of the exploit, intermediate findings, failed approaches, memory-layout analysis, and reproduction evidence.
English-translated repository:
yanoshercohen/php2shell-bypass-aslr-exp-en
Original project by 9bie:
9bie/php2shell-bypass-aslr-exp
All credit for the vulnerability research and exploit development belongs to the original author. My contribution is making the existing research materials and code commentary accessible in English.
Sharing this for anyone who wants to explore the research beyond the README.
1 point · 4 comments
In the ever-growing sea of AI slop exploits out there, this is the closest I've seen to being viable:
9bie/php2shell-bypass-aslr-exp
With two **large** caveats:
1) It requires specific, albeit plausible, configuration options for PHP.
2) […]
[Original post on infosec.exchange]
1 like
2 hours before your comment a working PoC on github was posted that did the 'hard part' that a random AI prompt was unlikely to find.
9bie/php2shell-bypass-aslr-exp
9bie/php2shell-bypass-aslr-exp is the real deal.
9bie/php2shell-bypass-aslr-exp
Buy 5$ on deepseek and have it write a script to grind out the right offsets to use for the most popular docker images.
I got it working just now; shell on any docker image i pull.
GG this dumb ass blog-post and thread.
Mentions
Interesting, can you give some more info? The best path forward I found was using 9bie/php2shell-bypass-aslr-exp and figuring out how to shrink the B1 leak down to >1.21MiB
fyi for anyone who heard that there isn't a php2shell poc that works on a default server configuration that isn't true 9bie/php2shell-bypass-aslr-exp `python3 exploit.py --port 18110 --workers 150` gets rce on `podman run --rm -it -p 127.0.0.1:18110:80 -v ./docker/www […]
Did some more digging into the publicly available RCE exploits for #php2shell and the results look pretty sobering: The arguably most promising one is 9bie's (9bie/php2shell-bypass-aslr-exp), which I spent some time looking at. TL;DR: It works, but only under very controlled […]
@LiveOverflow Already there in labs, is also handled in similar way on 9bie/php2shell-bypass-aslr-exp and TheCyberGeek/php2shell-research . The problem that you need to address on that in reality is the additional user/ normal operation. Ideally you will need to consume all workers and release 1.
12h before your comment the difficult part a random AI prompt was unlikely to find already dropped on github 9bie/php2shell-bypass-aslr-exp
[Project] I translated the full PHP 8.4.26 HTTP-only RCE research repository into English, including technical documentation and code comments I recently came across 9bie's php2shell research, which demonstrates an HTTP-only RCE exploit chain against PHP 8.4.26, including an ASLR bypass, under the official production configuration. While the original repository already provides an English README, much of the detailed research documentation and code commentary is written in Chinese. To make the research more accessible to the international security community, I put together an English-translated version of the repository, covering the technical documentation and code comments while preserving the original implementation and project structure. For context, the original research demonstrates: - Remote code execution using HTTP requests only. - An ASLR bypass using out-of-bounds memory disclosure. - Exploitation without enabling display_errors or modifying the default 128 MB memory limit. - A multi-stage exploitation chain involving PHP session-state corruption, heap manipulation, and control-flow hijacking. - Successful reproduction under the official Apache prefork configuration, with a reported 10/10 success rate in the tested environment. The repository also contains extensive technical notes covering the development of the exploit, intermediate findings, failed approaches, memory-layout analysis, and reproduction evidence. English-translated repository: yanoshercohen/php2shell-bypass-aslr-exp-en Original project by 9bie: 9bie/php2shell-bypass-aslr-exp All credit for the vulnerability research and exploit development belongs to the original author. My contribution is making the existing research materials and code commentary accessible in English. Sharing this for anyone who wants to explore the research beyond the README.
In the ever-growing sea of AI slop exploits out there, this is the closest I've seen to being viable: 9bie/php2shell-bypass-aslr-exp With two **large** caveats: 1) It requires specific, albeit plausible, configuration options for PHP. 2) […] [Original post on infosec.exchange]
2 hours before your comment a working PoC on github was posted that did the 'hard part' that a random AI prompt was unlikely to find. 9bie/php2shell-bypass-aslr-exp
9bie/php2shell-bypass-aslr-exp is the real deal.
9bie/php2shell-bypass-aslr-exp Buy 5$ on deepseek and have it write a script to grind out the right offsets to use for the most popular docker images. I got it working just now; shell on any docker image i pull. GG this dumb ass blog-post and thread.