The WordPress Chain Massacre From Constrained PHP Execution ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://blog.calif.io/p/the-wordpress-chain-massacre
• Blog Title: The WordPress Chain Massacre: From Constrained PHP Execution to Linux Root
• Suggested Section: Pentesting Web > PHP Tricks > disable_functions bypass, with cross-references to Deserialization > PHP, Binary Exploitation > ROP, and Linux Privilege Escalation > Copy Fail

🎯 Content Summary

wp2root is a post-exploitation chain that starts with constrained PHP execution on a WordPress server, escapes PHP interpreter restrictions through memory corruption, gains native code execution using a self-resolving ROP chain, and finally obtains Linux root through the Copy Fail local privilege-escalation technique.

PHP execution via wp2shell
  -> PHP Serializable use-after-free
  -> arbitrary memory read
  -> self-resolving ROP
  ->...
🔧 Technical Details
Recursive deserialization UAF to arbitrary read: In PHP's legacy Serializable implementation, trigger a user-defined unserialize() method that recursively calls the built-in unserialize() before the outer parser has finished. If the engine does not acquire the serialization lock before invoking the user method, both parsers can share one reference table. Force the inner operation to resize a property table, freeing buckets still referenced by the outer operation, and reclaim that allocation with sprayed strings. The stale references then resolve into attacker-controlled bytes interpreted as forged zval structures. Representing a forged zval as a string creates an arbitrary-read primitive over the process address space.
Bypassing PHP disable_functions through native code: PHP configuration can remove a dangerous function's language-level name without necessarily remov...
🤖 Agent Actions
Updated 1 file:

src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-via-mem.md

What I added:

reframed the page around memory-based disable_functions bypasses
kept the classic /proc/self/mem PLT/GOT-overwrite PoC
added concise coverage of the wp2root techniques that were not already documented there:

recursive Serializable UAF -> arbitrary read
direct native handler recovery despite disable_functions
self-resolving ROP from the live PHP image
fileless memfd_create + execveat(..., AT_EMPTY_PATH) helper staging
Copy Fail follow-on and useful detection indicators


added internal cross-links to:

PHP deserialization
ROP
Copy Fail


added a numbered ## References section and inline superscript citations

Verification:

checked the edited file content
verified the 3 internal relative links resolve correctly
mdbook build could not be run because mdbook is not installed in this environment


This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.
📚 Repository Maintenance

MD files processed: 990
MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://blog.calif.io/p/the-wordpress-chain-massacre

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > PHP Tricks > disable_functions bypass, with cross-references to Deserialization > PHP, Binary Exploitation > ROP, and Linux Privilege Escalation > Copy Fail".

Repository Maintenance:

• MD Files Formatting: 990 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0