Skip to content

Commit 2881363

Browse files
devploitdevploit
committed
Standardize architecture naming on aarch64
1 parent 56e2c95 commit 2881363

17 files changed

Lines changed: 179 additions & 31 deletions

‎README.md‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -31,20 +31,20 @@ not match the profile.
3131

3232
| Build | Image | Profile | Heap leak | libphp leak | RCE | Notes |
3333
| --- | --- | --- | --- | --- | --- | --- |
34-
| PHP 8.5.11 arm64 | `php:8.5.11-apache` (linux/arm64) | `php-8.5.11-bookworm-aarch64` | yes | yes | **yes** | `uid=33(www-data)` |
35-
| PHP 8.5.11 amd64 | `php:8.5.11-apache` (linux/amd64) | `php-8.5.11-bookworm-amd64` | yes | yes | **yes** | separate offsets, same `htdata` |
36-
| PHP 8.5.10 arm64 | `php:8.5.10-apache` | `php-8.5.10-bookworm-aarch64` | yes | yes | **yes** | `uid=33(www-data)` |
34+
| PHP 8.5.11 aarch64 | `php:8.5.11-apache` | `php-8.5.11-bookworm-aarch64` | yes | yes | **yes** | `uid=33(www-data)` |
35+
| PHP 8.5.11 amd64 | `php:8.5.11-apache` | `php-8.5.11-bookworm-amd64` | yes | yes | **yes** | separate offsets, same `htdata` |
36+
| PHP 8.5.10 aarch64 | `php:8.5.10-apache` | `php-8.5.10-bookworm-aarch64` | yes | yes | **yes** | `uid=33(www-data)` |
3737
| PHP 8.4.26 amd64 | `php:8.4.26-apache` | `php-8.4.26-bookworm-amd64` | yes | yes | **yes** | reference build |
38-
| PHP 8.4.25 arm64 | `php:8.4.25-apache` | `php-8.4.25-bookworm-aarch64` | yes | yes | **yes** | probabilistic stage 3; retries |
39-
| PHP 8.5.0 arm64 | `php:8.5.0-apache` | `php-8.5.0-bookworm` | yes | yes | no | stage-3 layout not found |
40-
| PHP 8.3.35 arm64 | `php:8.3.35-apache` | `php-8.3.35-bookworm-aarch64` | yes | yes | no | stage-3 reference alive |
38+
| PHP 8.4.25 aarch64 | `php:8.4.25-apache` | `php-8.4.25-bookworm-aarch64` | yes | yes | **yes** | probabilistic stage 3; retries |
39+
| PHP 8.5.0 aarch64 | `php:8.5.0-apache` | `php-8.5.0-bookworm` | yes | yes | no | stage-3 layout not found |
40+
| PHP 8.3.35 aarch64 | `php:8.3.35-apache` | `php-8.3.35-bookworm-aarch64` | yes | yes | no | stage-3 reference alive |
4141
| PHP 8.3.33 mod_php | `wordpress:7.1.1-apache` | `php-8.3.33-wordpress-mod_php` | yes | yes | no | stage-3 reference alive |
42-
| PHP 8.3.0 arm64 | `php:8.3.0-apache` | `php-8.3.0-bookworm` | no | no | no | `PS(id)` dangling; cookie not reclaimed |
43-
| PHP 8.2.34 arm64 | `php:8.2.34-apache` | `php-8.2.34-bookworm-aarch64` | no | no | no | UAF; leak shape differs |
44-
| PHP 8.1.34 arm64 | `php:8.1-apache` | `php-8.1.34-bookworm-aarch64` | no | no | no | UAF; leak shape differs |
45-
| PHP 8.0.30 arm64 | `php:8.0-apache` | `php-8.0.30-bookworm-aarch64` | no | no | no | UAF; leak shape differs |
46-
| PHP 7.4.33 arm64 | `php:7.4-apache` | `php-7.4.33-bookworm-aarch64` | no | no | no | UAF; leak shape differs |
47-
| PHP 8.2.0 arm64 | `php:8.2.0-apache` | — (offsets only) | n/a | n/a | no | no heap profile |
42+
| PHP 8.3.0 aarch64 | `php:8.3.0-apache` | `php-8.3.0-bookworm` | no | no | no | `PS(id)` dangling; cookie not reclaimed |
43+
| PHP 8.2.34 aarch64 | `php:8.2.34-apache` | `php-8.2.34-bookworm-aarch64` | no | no | no | UAF; leak shape differs |
44+
| PHP 8.1.34 aarch64 | `php:8.1-apache` | `php-8.1.34-bookworm-aarch64` | no | no | no | UAF; leak shape differs |
45+
| PHP 8.0.30 aarch64 | `php:8.0-apache` | `php-8.0.30-bookworm-aarch64` | no | no | no | UAF; leak shape differs |
46+
| PHP 7.4.33 aarch64 | `php:7.4-apache` | `php-7.4.33-bookworm-aarch64` | no | no | no | UAF; leak shape differs |
47+
| PHP 8.2.0 aarch64 | `php:8.2.0-apache` | — (offsets only) | n/a | n/a | no | no heap profile |
4848

4949
**13 heap profiles, 5 with verified RCE. Offsets extracted for 12 builds.**
5050

@@ -172,7 +172,7 @@ A profile is per build:
172172

173173
## Architecture selection
174174

175-
Some versions ship more than one build. PHP 8.5.11 has separate arm64 and amd64
175+
Some versions ship more than one build. PHP 8.5.11 has separate aarch64 and amd64
176176
offsets:
177177

178178
- local container: the dispatcher reads `uname -m` and selects the matching

‎docs/inventory-growth.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
| Layer | Coverage |
66
| --- | --- |
77
| Offset inventory | 12 builds: 7.4.33, 8.0.30, 8.1.34, 8.2.0, 8.2.34, 8.3.0, 8.3.35, 8.4.25, 8.4.26, 8.5.0, 8.5.10, 8.5.11 |
8-
| Heap profiles | 8.3.33, 8.3.35 (leaks); 8.4.25, 8.4.26, 8.5.10, 8.5.11 arm64/amd64 (RCE); 7.4/8.0/8.1/8.2 (offsets only) |
9-
| Verified RCE | 8.4.25 arm64, 8.4.26 amd64, 8.5.10 arm64, 8.5.11 arm64, 8.5.11 amd64 |
8+
| Heap profiles | 8.3.33, 8.3.35 (leaks); 8.4.25, 8.4.26, 8.5.10, 8.5.11 aarch64/amd64 (RCE); 7.4/8.0/8.1/8.2 (offsets only) |
9+
| Verified RCE | 8.4.25 aarch64, 8.4.26 amd64, 8.5.10 aarch64, 8.5.11 aarch64, 8.5.11 amd64 |
1010
| Labs | `:8100`-`:8106`, one per build |
1111
| Catalog | all vulnerable branches 5.4 → 8.5, plus 8.6 RC |
1212

‎docs/offset-inventory.md‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,18 @@ a build still needs heap calibration before the chain can run.
55

66
| Image | PHP | Arch | `zif_system` | `zval_ptr_dtor` | libphp sha256 | Status |
77
| --- | --- | --- | --- | --- | --- | --- |
8-
| php:7.4-apache | 7.4.33 | arm64 | 0x309640 | 0x3f6024 | 4cb16c7db838 | offsets extracted; heap not calibrated |
9-
| php:8.0-apache | 8.0.30 | arm64 | 0x31ef70 | 0x40ddb0 | 35d769430309 | offsets extracted; heap not calibrated |
10-
| php:8.1-apache | 8.1.34 | arm64 | 0x341e08 | 0x42e7a0 | f7640ea4ad0a | offsets extracted; heap not calibrated |
11-
| php:8.2.0-apache | 8.2.0 | arm64 | 0x364f30 | 0x4520c0 | 322c858efd29 | offsets extracted; heap not calibrated |
12-
| php:8.2.34-apache | 8.2.34 | arm64 | 0x36ff48 | 0x4606c0 | db406c7f48eb | offsets extracted; heap not calibrated |
13-
| php:8.3.0-apache | 8.3.0 | arm64 | 0x3771f0 | 0x467cf0 | c1b72099fc8c | offsets extracted; heap not calibrated |
14-
| php:8.3.35-apache | 8.3.35 | arm64 | 0x377428 | 0x46fcc0 | 1f2bc20742e6 | offsets extracted; heap not calibrated |
15-
| php:8.4.25-apache | 8.4.25 | arm64 | 0x42fa30 | 0x637ae0 | 2d2388a4b0af | offsets extracted; heap not calibrated |
8+
| php:7.4-apache | 7.4.33 | aarch64 | 0x309640 | 0x3f6024 | 4cb16c7db838 | offsets extracted; heap not calibrated |
9+
| php:8.0-apache | 8.0.30 | aarch64 | 0x31ef70 | 0x40ddb0 | 35d769430309 | offsets extracted; heap not calibrated |
10+
| php:8.1-apache | 8.1.34 | aarch64 | 0x341e08 | 0x42e7a0 | f7640ea4ad0a | offsets extracted; heap not calibrated |
11+
| php:8.2.0-apache | 8.2.0 | aarch64 | 0x364f30 | 0x4520c0 | 322c858efd29 | offsets extracted; heap not calibrated |
12+
| php:8.2.34-apache | 8.2.34 | aarch64 | 0x36ff48 | 0x4606c0 | db406c7f48eb | offsets extracted; heap not calibrated |
13+
| php:8.3.0-apache | 8.3.0 | aarch64 | 0x3771f0 | 0x467cf0 | c1b72099fc8c | offsets extracted; heap not calibrated |
14+
| php:8.3.35-apache | 8.3.35 | aarch64 | 0x377428 | 0x46fcc0 | 1f2bc20742e6 | offsets extracted; heap not calibrated |
15+
| php:8.4.25-apache | 8.4.25 | aarch64 | 0x42fa30 | 0x637ae0 | 2d2388a4b0af | offsets extracted; heap not calibrated |
1616
| php:8.4.26-apache | 8.4.26 | amd64 | 0x465370 | 0x65eb60 | 51663cf883b1 | offsets extracted; heap not calibrated |
17-
| php:8.5.0-apache | 8.5.0 | arm64 | 0x503510 | 0x731d80 | 5910f3f12fbd | offsets extracted; heap not calibrated |
18-
| php:8.5.10-apache | 8.5.10 | arm64 | 0x52e130 | 0x75d360 | 5f080d44d3f8 | offsets extracted; heap not calibrated |
19-
| php:8.5.11-apache | 8.5.11 | arm64 | 0x5314f0 | 0x761b80 | 64a617aeb392 | offsets extracted; heap not calibrated |
17+
| php:8.5.0-apache | 8.5.0 | aarch64 | 0x503510 | 0x731d80 | 5910f3f12fbd | offsets extracted; heap not calibrated |
18+
| php:8.5.10-apache | 8.5.10 | aarch64 | 0x52e130 | 0x75d360 | 5f080d44d3f8 | offsets extracted; heap not calibrated |
19+
| php:8.5.11-apache | 8.5.11 | aarch64 | 0x5314f0 | 0x761b80 | 64a617aeb392 | offsets extracted; heap not calibrated |
2020

2121
## Notes
2222

‎docs/reproducibility.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ Typical wall time is 7-15 seconds on a native host once the image is present.
8383
## 5. Other verified builds
8484

8585
```sh
86-
# 8.5.11 arm64
86+
# 8.5.11 aarch64
8787
python3 tools/php2shell_auto.py -u http://127.0.0.1:8106/index.php --container p2s-lab-8511 --memory-limit-mb 8
8888

8989
# 8.5.11 amd64 (separate offsets; --arch is auto-detected for local containers)
@@ -95,7 +95,7 @@ python3 tools/php2shell_auto.py -u http://127.0.0.1:<port>/index.php \
9595
--profile 8.4.25-bookworm-aarch64 --memory-limit-mb 8
9696
```
9797

98-
A version with several builds (8.5.11 arm64/amd64) needs `--profile`; the
98+
A version with several builds (8.5.11 aarch64/amd64) needs `--profile`; the
9999
offsets differ even though `htdata` is the same.
100100

101101
## 6. Calibration workflow
@@ -117,7 +117,7 @@ profile that only leaks is stored with `rce: false`.
117117

118118
- **8.4.26**: amd64 image; on arm64 it runs under emulation. The profile is
119119
`php-8.4.26-bookworm-amd64`.
120-
- **8.5.11**: arm64 and amd64 have different offsets; use the matching profile.
120+
- **8.5.11**: aarch64 and amd64 have different offsets; use the matching profile.
121121
- **8.4.25**: stage 3 is probabilistic; run with the default retries.
122122
- **8.3.35 / 8.3.33**: stage 1-2 work; stage 3 is blocked by a live session
123123
reference, not a calibration error.

‎profiles/offsets/7.4.33-aarch64.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"image": "php:7.4-apache",
3+
"php_version": "7.4.33",
4+
"branch": "7.4",
5+
"arch": "aarch64",
6+
"libphp": {
7+
"zif_system": "0x309640",
8+
"zval_ptr_dtor": "0x3f6024",
9+
"ps_globals": "0xd15738"
10+
},
11+
"libphp_sha256": "4cb16c7db838b8acf2d84256ba1798c883655de90ccc6323b9ccf37ddc07ad91",
12+
"status": "offsets extracted; heap not calibrated"
13+
}

‎profiles/offsets/8.0.30-aarch64.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"image": "php:8.0-apache",
3+
"php_version": "8.0.30",
4+
"branch": "8.0",
5+
"arch": "aarch64",
6+
"libphp": {
7+
"zif_system": "0x31ef70",
8+
"zval_ptr_dtor": "0x40ddb0",
9+
"ps_globals": "0xe37d50"
10+
},
11+
"libphp_sha256": "35d769430309385936499d87b612c9b998c5a54844ed97cb4a521de12410b931",
12+
"status": "offsets extracted; heap not calibrated"
13+
}

‎profiles/offsets/8.1.34-aarch64.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"image": "php:8.1-apache",
3+
"php_version": "8.1.34",
4+
"branch": "8.1",
5+
"arch": "aarch64",
6+
"libphp": {
7+
"zif_system": "0x341e08",
8+
"zval_ptr_dtor": "0x42e7a0",
9+
"ps_globals": "0xecc350"
10+
},
11+
"libphp_sha256": "f7640ea4ad0a9841a84b283cbbed7329be9d83d402b9aca90582dfe22df5e526",
12+
"status": "offsets extracted; heap not calibrated"
13+
}

‎profiles/offsets/8.2.0-aarch64.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"image": "php:8.2.0-apache",
3+
"php_version": "8.2.0",
4+
"branch": "8.2",
5+
"arch": "aarch64",
6+
"libphp": {
7+
"zif_system": "0x364f30",
8+
"zval_ptr_dtor": "0x4520c0",
9+
"ps_globals": "0xefd860"
10+
},
11+
"libphp_sha256": "322c858efd29c4ed45a3f6e8780718b0d557967cd94dbe8b74c434e22cff2aff",
12+
"status": "offsets extracted; heap not calibrated"
13+
}

‎profiles/offsets/8.2.34-aarch64.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"image": "php:8.2.34-apache",
3+
"php_version": "8.2.34",
4+
"branch": "8.2",
5+
"arch": "aarch64",
6+
"libphp": {
7+
"zif_system": "0x36ff48",
8+
"zval_ptr_dtor": "0x4606c0",
9+
"ps_globals": "0xf0c998"
10+
},
11+
"libphp_sha256": "db406c7f48eb3ab2141a87c1bfef3b3aecc114851419b1b1efb25d51670d5a21",
12+
"status": "offsets extracted; heap not calibrated"
13+
}

‎profiles/offsets/8.3.0-aarch64.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"image": "php:8.3.0-apache",
3+
"php_version": "8.3.0",
4+
"branch": "8.3",
5+
"arch": "aarch64",
6+
"libphp": {
7+
"zif_system": "0x3771f0",
8+
"zval_ptr_dtor": "0x467cf0",
9+
"ps_globals": "0x100cb70"
10+
},
11+
"libphp_sha256": "c1b72099fc8c153a57df69cc9b028fc7c97435f981be8799ba9592f1ff14bffb",
12+
"status": "offsets extracted; heap not calibrated"
13+
}

0 commit comments

Comments
 (0)