9bie/php2shell-bypass-aslr-exp

The problem

Most published PHP exploit chains quietly assume a weakened target: display_errors=On, a tiny memory_limit, a custom ini, or a debugger attached. Real deployments run php.ini-production with errors off and 128M, and a researcher who needs to prove a stock setup is exploitable has nothing to point at. This project reproduces RCE against the official image, official ini and official 150-worker prefork config, delivered over plain HTTP against a page whose only code is <?php echo "OK\n"; ?>.

What's different

The usual approach to PHP memory-corruption research is either a custom-built target with symbols and a debugger, or a chain that depends on non-default settings for the leak. Here the chain is built from chunked multipart requests that bypass post_max_size, a bailout that leaves dangling session state after an OOM in END cleanup, an out-of-bounds read via Set-Cookie to leak heap and libphp addresses, and a second OOM that redirects hash_serialize_verifier to a forged zend_array. Worker pinning — occupying 149 of 150 children with half-sent POSTs — is what makes the cross-request dangling pointer land on the same child. The README is unusually explicit about the mechanics and ships per-run evidence logs rather than a single demo video.

Who it's for

Security researchers and pentesters doing authorized work on PHP/Apache stacks, and defenders who want to understand how far a pure-HTTP memory-corruption chain can go on a default build. It is useful for WAF and detection engineering: the traffic is just chunked multipart and ordinary GET/POST, which is worth studying. It is not for anyone looking for a general-purpose scanner — the offsets are calibrated for PHP 8.4.26 NTS mod_php on Debian 13, and anything else needs re-calibration. Hobbyists shouldn't run it against systems they don't own; the README itself scopes it to authorized environments.

Cost of adoption

You need Docker (or sudo docker) to bring up the target, Python 3 for the exploit script, and a matching architecture — the project claims x86_64 and aarch64 profiles, with --arch auto detection. Changing PHP build or version invalidates the offset table, so expect real work to re-derive offsets. There is no declared license, which is a genuine blocker for any commercial or redistribution use. Maturity is thin: a README, one script, and evidence logs, no test suite. The README is the install guide; it shows cloning the repo and running ./pure/run_pure.sh before the exploit script.

Verdict

This is a brand-new repository — three days old, 1399 stars, averaging +421 per day and reaching #11 on a new board — and it carries the shape of a concentrated disclosure spike rather than an established tool. The technical content is unusually concrete, with named offsets and per-run logs, which is why it drew attention quickly. But with no license, a narrow target matrix and no obvious maintenance plan, treat it as a research artifact and a detection-engineering reference, not as infrastructure. Expect the offset profiles and the chain itself to age quickly as PHP is patched.