[GitHub] php2shell-exp

Rce

Type

N/A

CVSS Score

Views

Anonymous

Author

Description

Patch-derived PoC and RCE for the PHP session upload-progress pre-RINIT decode (CVE-2026-109618/CVE-2026-109619)

# php2shell-exp

PoC and RCE reverse-engineered from the PHP official patch [`3584a98bda`](https://github.com/php/php-src/commit/3584a98bda), with dual-container differential environments for 8.2.34 / 8.2.35.

Patch-derived PoC and RCE for the pre-RINIT session decode in PHP's upload-progress handler.

## What This Is

- `exp/poc_pre_rinit.py` — Demonstrates that upload-progress decodes session before RINIT and executes object destructors, without command execution
- `exp/exp_rce.py` — Executes arbitrary commands on the same code path, with output read back via HTTP
- `exp/poc_oom.py` — OOM trigger for CVE-2026-109618 (trigger only, not RCE)
- `lab/` — `php:8.2.34-fpm` and `php:8.2.35-fpm`, each with nginx

This chain works reliably on 8.2.34 and is blocked on 8.2.35 by `incomplete_classes_only`. It is not a zero-dependency exploit: the target must already have a class with dangerous magic methods before RINIT; the lab simulates this with `opcache.preload`.

## Verified

Same code, same config, image swap only:

| Branch | Exploitable | Fixed |
|---|---|---|
| 8.1 | 8.1.34 (EOL, no official patch) | — |
| 8.2 | 8.2.34 | 8.2.35 |
| 8.3 | 8.3.35 | 8.3.36 |
| 8.4 | 8.4.26 | 8.4.27 |
| 8.5 | 8.5.11 | 8.5.12 |

Output of `./verify.sh` on the 8.2 branch:

```
PoC 8.2.34 (expect 0) 0
PoC 8.2.35 (expect 1) 1
RCE 8.2.34 (expect 0) 0
RCE 8.2.35 (expect 1) 1
[+] differential holds
```

Full output and call stack diagnostics in [`docs/RESULTS.md`](docs/RESULTS.md).

## Mechanism

The patch marks upload-progress decoding as "pre-RINIT, no user code allowed" and enables `incomplete_classes_only` for this phase. Before the patch, this decoding instantiates objects from session records as their true classes, with `__wakeup` / `__unserialize` / `Serializable::unserialize` / `__destruct` all running before the target script compiles.

The exploit proceeds in two steps, entirely over HTTP:

1. `POST /app/upload.php`. The `.user.ini` in that directory sets `session.serialize_handler=php_serialize`; upload-progress writes the multipart filename as-is to the session file, `x|O:6:"PrePwn":...` with the pipe included.
2. `POST /api/pre.php`. This directory uses the default `php` handler, and the script has no `session_start()`. During request startup, `php_session_rfc1867_update()` still decodes: the `php` decoder splits at the first `|` and passes the second half to `unserialize()`.
3. On 8.2.34, the object is created as its true class, `__destruct()` executes `shell_exec($cmd)`, and output is written to a random file in webroot.
4. On 8.2.35, the same data is downgraded to `__PHP_Incomplete_Class`, which has no destructor and produces no file.

The payload is explicitly constructed by `exp/lib2shell.py::php_object()`, with length prefixes calculated in bytes:

```
x|O:6:"PrePwn":2:{s:3:"cmd";s:12:"id; hostname";s:3:"out";s:33:"/var/www/html/.pwn_xxxxxxxx.txt";}
```

Line-by-line correspondence between the patch hunks and code in [`docs/DERIVATION.md`](docs/DERIVATION.md).

## Quick Start

Requires Docker Compose and Python 3.8+ (standard library only).

```

Translated to English from Chinese. Show original · see the source links.

Original (Chinese):

Patch-derived PoC and RCE for the PHP session upload-progress pre-RINIT decode (CVE-2026-109618/109619)

# php2shell-exp

从 PHP 官方补丁 [`3584a98bda`](https://github.com/php/php-src/commit/3584a98bda) 反推的 PoC 与 RCE，附带 8.2.34 / 8.2.35 双容器差分环境。

Patch-derived PoC and RCE for the pre-RINIT session decode in PHP's upload-progress handler.

## 这是什么

- `exp/poc_pre_rinit.py` — 证明 upload-progress 在 RINIT 之前解码 session 并执行对象析构器，不执行命令
- `exp/exp_rce.py` — 同一条路径上执行任意命令，输出经 HTTP 回读
- `exp/poc_oom.py` — CVE-2026-109618 的 OOM 触发（仅触发，不是 RCE）
- `lab/` — `php:8.2.34-fpm` 与 `php:8.2.35-fpm`，各带 nginx

这条链在 8.2.34 上稳定打通，在 8.2.35 上被 `incomplete_classes_only` 挡住。它不是零依赖利用：需要目标在 RINIT 之前已经存在一个带危险魔术方法的类，lab 用 `opcache.preload` 模拟。

## 已验证

同一份代码、同一份配置，只换镜像：

| 分支 | 可利用 | 已修复 |
|---|---|---|
| 8.1 | 8.1.34（EOL，无官方修复） | — |
| 8.2 | 8.2.34 | 8.2.35 |
| 8.3 | 8.3.35 | 8.3.36 |
| 8.4 | 8.4.26 | 8.4.27 |
| 8.5 | 8.5.11 | 8.5.12 |

`./verify.sh` 在 8.2 分支上的输出：

```
PoC 8.2.34 (expect 0) 0
PoC 8.2.35 (expect 1) 1
RCE 8.2.34 (expect 0) 0
RCE 8.2.35 (expect 1) 1
[+] differential holds
```

完整输出和调用栈诊断见 [`docs/RESULTS.md`](docs/RESULTS.md)。

## 原理

补丁把 upload-progress 的解码标成“RINIT 之前，不允许用户代码”，并对该阶段启用 `incomplete_classes_only`。打补丁前，这段解码会把 session 记录里的对象按真实类实例化，`__wakeup` / `__unserialize` / `Serializable::unserialize` / `__destruct` 都在目标脚本编译之前运行。

利用分两步，全部走 HTTP：

1. `POST /app/upload.php`。该目录 `.user.ini` 设 `session.serialize_handler=php_serialize`；upload-progress 把 multipart filename 原样写进 session 文件，`x|O:6:"PrePwn":...` 连同竖线一起落盘。
2. `POST /api/pre.php`。该目录用默认 `php` handler，脚本里没有 `session_start()`。请求启动阶段 `php_session_rfc1867_update()` 仍然会解码：`php` 解码器在第一个 `|` 处切开，把后半段交给 `unserialize()`。
3. 8.2.34 上对象按真实类创建，`__destruct()` 执行 `shell_exec($cmd)`，输出写到 webroot 下的随机文件。
4. 8.2.35 上同一段数据被降级为 `__PHP_Incomplete_Class`，没有析构器，也没有文件。

Payload 由 `exp/lib2shell.py::php_object()` 显式拼出，长度前缀按字节计算：

```
x|O:6:"PrePwn":2:{s:3:"cmd";s:12:"id; hostname";s:3:"out";s:33:"/var/www/html/.pwn_xxxxxxxx.txt";}
```

补丁 hunk 与代码的逐条对应见 [`docs/DERIVATION.md`](docs/DERIVATION.md)。

## 快速开始

需要 Docker Compose 和 Python 3.8+（仅标准库）。

```

References

https://github.com/BoheSama1999/php2shell-exp

[GitHub] php2shell-exp

Description

References

Community Rating

Quick Actions

Related Exploits