JoasASantos / php2shell-exploit

# php2shell-exploit
Universal PHP RCE exploit for **CVE-2026-109618** / **CVE-2026-109619**.
Pre-auth, cookie-less, pure-HTTP remote code execution via `session.upload_progress` use-after-free. Heap-based ASLR bypass + function pointer overwrite = shell.
**Created by: Joas A Santos (@c0d3cr4zy)**
## Disclaimer
**Authorized security testing, research, and education ONLY.** Unauthorized access is illegal. Authors not responsible for misuse.
## Affected Versions
| Branch | Vulnerable | Patched |
|--------|-----------|---------|
| PHP 8.5 | **Note:** The exploit targets PHP's `session.upload_progress` handler, not the application. Any PHP endpoint on a vulnerable server works as entry point — no authentication or application-specific interaction required.
## Mitigation
 [code] 
Or upgrade to PHP 8.4.27+ / 8.3.36+ / 8.2.35+ / 8.5.12+.
## Roadmap — Full Wiz Technique Replication
Current exploit uses `pDestructor=zif_system` (worker crashes after RCE). Wiz's original php2shell achieves **crash-free single-request in-band execution** via a different primitive. Steps to replicate:
1. **Locate `PG(auto_prepend_file)` offset in libphp BSS**
 - `PG()` macro accesses `core_globals` struct in `.bss`
 - `auto_prepend_file` is a `char*` field at known offset within `php_core_globals`
 - Need: `objdump -t libphp.so | grep core_globals` + struct offset from PHP headers
2. **Arbitrary write primitive via fake HashTable**
 - Instead of `pDestructor=zif_system`, use `pDestructor` pointing to a gadget that writes to controlled address
 - Or: craft fake `zend_array` whose destruction writes a pointer value to `PG(auto_prepend_file)` via `arData` manipulation
 - Alternative: use `zif_ini_set` as pDestructor target to call `ini_set("auto_prepend_file", "/tmp/p2s.php")`
3. **Write PHP payload to /tmp/**
 - First chain: `pDestructor=zif_system` → `echo ' ' > /tmp/p2s.php`
 - Worker crashes (acceptable for setup)
4. **Overwrite `PG(auto_prepend_file)` pointer**
 - Second chain: arbitrary write primitive sets `PG(auto_prepend_file)` = heap address containing `/tmp/p2s.php\0`
 - Worker crashes again (acceptable for setup)
5. **In-band execution on next request**
 - Normal GET request → PHP auto-prepends `/tmp/p2s.php`
 - Code runs as legitimate PHP → output in HTTP response
 - No crash, no fake execute_data, no SIGSEGV
 - Worker survives indefinitely
**Key research question:** Can `zif_ini_set` be used as `pDestructor` target? If yes, step 2+4 collapse into one chain — `ini_set("auto_prepend_file", "/tmp/p2s.php")` directly, no BSS offset needed.
## References
- WizResearch — php2shell
- 9bie/php2shell-bypass-aslr-exp
- devploit/php2shell
- NCSC-NL/php2shell Advisory
## License
MIT — For authorized security testing only.