Skip to content

profile-inventory.md

Latest commit

 

History

History
81 lines (59 loc) · 3.4 KB

profile-inventory.md

File metadata and controls

81 lines (59 loc) · 3.4 KB
Raw

Profile inventory

Generated from profiles/*.json by tools/php2shell_inventory.py.

PHP Build zif_system zval_ptr_dtor htdata stage1_n forge stage2_t RCE
7.4.33 php-7.4.33-bookworm-aarch64 0x309640 0x3f6024 - - - - no
8.0.30 php-8.0.30-bookworm-aarch64 0x31ef70 0x40ddb0 - - - - no
8.1.34 php-8.1.34-bookworm-aarch64 0x341e08 0x42e7a0 - - - - no
8.2.34 php-8.2.34-bookworm-aarch64 0x36ff48 0x4606c0 - 0 0 406 no
8.3.33 php-8.3.33-wordpress-mod_php 0x377248 0x4737e0 - 815 63 406 no
8.3.35 php-8.3.35-bookworm-aarch64 0x377428 0x46fcc0 - 841 63 406 no
8.4.25 php-8.4.25-bookworm-aarch64 0x42fa30 0x637ae0 0x690d8 841 63 406 yes
8.4.26 php-8.4.26-bookworm-amd64 0x465370 0x65eb60 0x690d8 841 79 406 yes
8.5.10 php-8.5.10-bookworm-aarch64 0x52e130 0x75d360 0x690d8 841 63 406 yes
8.5.11 php-8.5.11-bookworm-amd64 0x5996e0 0x7b47a0 0x690d8 841 63 406 yes
8.5.11 php-8.5.11-bookworm-aarch64 0x5314f0 0x761b80 0x690d8 841 63 406 yes

Per-build notes

PHP 8.5.11 — RCE verified

php:8.5.11-apache, bookworm, mod_php prefork, one worker, display_errors=On, memory_limit=8M. The factory reproduced the full chain:

[*] stage1 probe: stale block taken by v0841
    N=841 len=63 -> cookie=4096 chunk=0xffff8f000000
[*] stage2 T=406 -> libphp=0xffff8bc00000
[+] stage3 0x690d8/bookworm: uid=33(www-data) ...
[*] rce=True

This is the 8.5 branch, fixed in 8.5.12.

PHP 8.4.26 — RCE verified

php:8.4.26-apache, bookworm. Verified 3/3 manually and through the factory. Fixed in 8.4.27. This is the profile used against the local 8.4.26 laboratory.

PHP 8.3.35 — leaks only

php:8.3.35-apache. Stage 1 (heap base) and stage 2 (libphp base) reproduce; stage 3 does not place the fake reference. rce=false. Fixed in 8.3.36.

PHP 8.3.33 — leaks only

wordpress:7.1.1-apache (PHP 8.3.33, mod_php). Stages 1-2 reproduced; stage 3 not calibrated. Fixed in 8.3.36.

PHP 8.2.34 — calibration failed

php:8.2.34-apache. The libphp offsets were extracted (0x36ff48 / 0x4606c0), but the 8.4/8.5 upload-progress leak shape did not reproduce: the stage-1 probe did not reveal the stale-block index and stage 2 found no libphp pointer. rce=false, no heap parameters.

Symbol offsets for more builds

docs/offset-inventory.md (generated by tools/php2shell_offsets.py) lists the zif_system / zval_ptr_dtor offsets for the official images of the EOL branches too:

PHP zif_system zval_ptr_dtor
7.4.33 0x309640 0x3f6024
8.0.30 0x31ef70 0x40ddb0
8.1.34 0x341e08 0x42e7a0

These are offsets only; no heap calibration was performed for 7.4, 8.0 or 8.1.

Coverage vs the catalog

catalog/vulnerable.json lists every branch from the advisory matrix (5.4 → 8.5, plus 8.6 RC). The profiles above cover the representative official images that were actually run. A version is exploitable only when a verified profile exists for its exact build; the dispatcher refuses to guess.

To add a build, append it to BUILDS in tools/php2shell_matrix.py and run the factory. Architecture matters: these profiles are aarch64; an x86_64 image produces its own offsets and heap layout.