php2shell/session-deser/.gitignore at 39f7f33938d6771e1d4b3ef69fa20f6e897faa7c - php2shell - Kurosek Git

Files

T

neko 7fecd435cc Session deserialization RCE via serialize_handler mismatch (no LFI)

Exploits the interaction between php_serialize and php session handlers:
when one endpoint writes sessions with php_serialize (Laravel, Symfony
default) and another reads with the php handler (PHP default), injected
pipe characters cause arbitrary deserialization at session_start().

12 built-in POP chains covering current and legacy library versions:
- monolog3-fw: Monolog 3.0+ (tested 3.12.1, latest)
- laravel10-cmd/fw: illuminate 10.0-13.x+ (tested v13.38.0, latest)
- monolog-cmd/fw: Monolog 1.17.2-2.x
- laravel-cmd/fw: illuminate 5.4-8.x
- guzzle-fw: Guzzle 4.0-7.x
- symfony-cmd/fw: Symfony 2.6-4.4.18
- wordpress-cmd/fw: WordPress 6.4.0-6.4.1

All chains tested end-to-end through the full HTTP exploit flow on
PHP 8.3. Accepts custom phpggc chains via --chain-file.

2026-10-21 20:47:37 +00:00

4 lines

35 B

Plaintext

Raw Blame History

	`vendor/`
	`__pycache__/`
	`composer.lock`