Fix remote pinning edge cases and add arch metadata to calibration

Author: devploit

profiles/schema.json

@@ -4,7 +4,17 @@
   "title": "PHP2Shell build profile",
   "description": "Per-build profile with libphp offsets, heap calibration parameters and RCE verification status.",
   "type": "object",
-  "required": ["name", "php_version", "branch", "sapi", "rce", "libphp", "stages", "config"],
+  "required": [
+    "name",
+    "php_version",
+    "branch",
+    "sapi",
+    "arch",
+    "rce",
+    "libphp",
+    "stages",
+    "config"
+  ],
   "properties": {
     "name": {
       "type": "string",
@@ -22,12 +32,17 @@
       "description": "PHP release branch, e.g. 8.4."
     },
     "fixed_in": {
-      "type": ["string", "null"],
+      "type": [
+        "string",
+        "null"
+      ],
       "description": "First patched version in this branch, or null for EOL branches."
     },
     "sapi": {
       "type": "string",
-      "enum": ["apache2handler"],
+      "enum": [
+        "apache2handler"
+      ],
       "description": "Server API. Only apache2handler (mod_php prefork) is supported."
     },
     "verified": {
@@ -40,7 +55,11 @@
     },
     "upstream_profile": {
       "type": "string",
-      "enum": ["bookworm", "bookworm-noexpose", "lab"],
+      "enum": [
+        "bookworm",
+        "bookworm-noexpose",
+        "lab"
+      ],
       "description": "Upstream exploit profile name passed to exploit.py."
     },
     "distro": {
@@ -49,13 +68,19 @@
     },
     "arch": {
       "type": "string",
-      "enum": ["aarch64", "amd64"],
+      "enum": [
+        "aarch64",
+        "amd64"
+      ],
       "description": "CPU architecture."
     },
     "libphp": {
       "type": "object",
       "description": "Symbol offsets relative to the libphp.so load base.",
-      "required": ["zif_system", "zval_ptr_dtor"],
+      "required": [
+        "zif_system",
+        "zval_ptr_dtor"
+      ],
       "properties": {
         "zif_system": {
           "type": "string",
@@ -68,7 +93,10 @@
           "description": "Offset of zval_ptr_dtor (the destructor the stage-3 hijack replaces)."
         },
         "htdata": {
-          "type": ["string", "null"],
+          "type": [
+            "string",
+            "null"
+          ],
           "pattern": "^0x[0-9a-fA-F]+$",
           "description": "Chunk-relative offset of the 167-byte live string used as stage-3 carrier. Null when stage 3 is not calibrated."
         }
@@ -100,17 +128,25 @@
           "description": "Value parameter for stage-2 calibration."
         },
         "stage3_pads": {
-          "type": ["array", "null"],
+          "type": [
+            "array",
+            "null"
+          ],
           "items": {
             "type": "array",
-            "items": { "type": "integer" },
+            "items": {
+              "type": "integer"
+            },
             "minItems": 2,
             "maxItems": 2
           },
           "description": "Padding pairs for stage-3 heap grooming. Null when stage 3 is not calibrated."
         },
         "stage3_carrier": {
-          "type": ["boolean", "null"],
+          "type": [
+            "boolean",
+            "null"
+          ],
           "description": "Whether the 167-byte carrier string is used. Null when stage 3 is not calibrated."
         }
       },
@@ -173,28 +209,56 @@
     },
     "memory_limit_tested_mb": {
       "type": "array",
-      "items": { "type": "integer", "minimum": 1 },
+      "items": {
+        "type": "integer",
+        "minimum": 1
+      },
       "description": "memory_limit values (in MiB) where RCE was verified."
     }
   },
-  "if": { "properties": { "rce": { "const": true } } },
+  "if": {
+    "properties": {
+      "rce": {
+        "const": true
+      }
+    }
+  },
   "then": {
-    "required": ["oom_mb"],
+    "required": [
+      "oom_mb"
+    ],
     "properties": {
       "libphp": {
-        "required": ["zif_system", "zval_ptr_dtor", "htdata"],
+        "required": [
+          "zif_system",
+          "zval_ptr_dtor",
+          "htdata"
+        ],
         "properties": {
-          "htdata": { "type": "string" }
+          "htdata": {
+            "type": "string"
+          }
         }
       },
       "stages": {
-        "required": ["stage1_n", "stage1_forge_len", "stage2_t", "stage2_v", "stage3_pads", "stage3_carrier"],
+        "required": [
+          "stage1_n",
+          "stage1_forge_len",
+          "stage2_t",
+          "stage2_v",
+          "stage3_pads",
+          "stage3_carrier"
+        ],
         "properties": {
-          "stage3_pads": { "type": "array" },
-          "stage3_carrier": { "type": "boolean" }
+          "stage3_pads": {
+            "type": "array"
+          },
+          "stage3_carrier": {
+            "type": "boolean"
+          }
         }
       }
     }
   },
   "additionalProperties": false
-}
+}

tests/test_core.py

@@ -22,6 +22,7 @@
 import php2shell_auto as auto  # noqa: E402
 import php2shell_ui as ui  # noqa: E402
 import php2shell_paths as paths  # noqa: E402
+import php2shell_calibrate as cal  # noqa: E402
 
 
 class ClassificationTests(unittest.TestCase):
@@ -60,6 +61,15 @@ def test_branch_only(self):
     def test_none(self):
         self.assertEqual(auto.select([], "8.4.26", "8.4"), (None, "none"))
 
+    def test_auto_remote_connection_timeout_is_safe(self):
+        with mock.patch.object(auto.socket, "create_connection", side_effect=socket.timeout):
+            self.assertIsNone(auto.WorkerPins.auto_remote("http://127.0.0.1:1", max_pins=1))
+
+    def test_container_arch_mapping(self):
+        result = SimpleNamespace(returncode=0, stdout="x86_64\n", stderr="")
+        with mock.patch.object(cal.subprocess, "run", return_value=result):
+            self.assertEqual(cal.container_arch("x"), "amd64")
+
     def test_remote_arch_required(self):
         self.assertTrue(auto.remote_arch_required(True, None, None))
         self.assertFalse(auto.remote_arch_required(True, "amd64", None))
@@ -159,6 +169,7 @@ def test_profile_schema_if_present(self):
             data = json.loads(schema.read_text())
             self.assertIn("$schema", data)
             self.assertEqual(data.get("type"), "object")
+            self.assertIn("arch", data.get("required", []))
 
     def test_catalog_structure(self):
         catalog = json.loads((ROOT / "catalog" / "vulnerable.json").read_text())

tools/php2shell_auto.py

@@ -345,6 +345,7 @@ def auto_remote(cls, url: str, max_pins: int = 32):
         path = u.path or "/"
         pins = []
         for _ in range(max_pins):
+            s = None
             try:
                 s = socket.create_connection((host, port), timeout=3)
                 if u.scheme == "https":
@@ -355,12 +356,18 @@ def auto_remote(cls, url: str, max_pins: int = 32):
                 s.settimeout(2)
                 data = s.recv(65536)
             except socket.timeout:
-                try:
-                    s.close()
-                except OSError:
-                    pass
+                if s is not None:
+                    try:
+                        s.close()
+                    except OSError:
+                        pass
                 break
             except OSError:
+                if s is not None:
+                    try:
+                        s.close()
+                    except OSError:
+                        pass
                 break
             if not data:
                 try:

tools/php2shell_calibrate.py

@@ -301,6 +301,16 @@ def calibrate_stage3(mod, ex, chunk, lib, zif, proof, hints):
     return False, None
 
 
+def container_arch(container: str) -> str | None:
+    try:
+        result = subprocess.run(["docker", "exec", container, "uname", "-m"],
+                                capture_output=True, text=True, timeout=10)
+    except (OSError, subprocess.SubprocessError):
+        return None
+    return {"aarch64": "aarch64", "arm64": "aarch64",
+            "x86_64": "amd64", "amd64": "amd64"}.get(result.stdout.strip().lower())
+
+
 def main() -> int:
     ap = argparse.ArgumentParser(description="Calibrate one PHP2Shell build profile.")
     ap.add_argument("--target", required=True)
@@ -315,8 +325,19 @@ def main() -> int:
     ap.add_argument("--stage3-htdata", type=lambda x: int(x, 0))
     ap.add_argument("--stage3-pads", choices=("bookworm", "lab"))
     ap.add_argument("--distro", default="unknown")
+    ap.add_argument("--arch", choices=("aarch64", "amd64"), default=None)
     args = ap.parse_args()
 
+    arch = args.arch or container_arch(args.container)
+    if arch is None:
+        for candidate in ("amd64", "aarch64"):
+            if candidate in args.distro:
+                arch = candidate
+                break
+    if arch is None:
+        print("[!] cannot determine target architecture; pass --arch", file=sys.stderr)
+        return 3
+
     patch_params(args.repo_dir)
     if args.target.startswith("https://"):
         patch_tls(args.repo_dir)
@@ -354,6 +375,8 @@ def main() -> int:
         "branch": branch,
         "fixed_in": f"{branch}.{fixed}" if fixed else None,
         "sapi": "apache2handler",
+        "arch": arch,
+        "distro": "debian" if "bookworm" in args.distro else args.distro,
         "verified": rce,
         "rce": rce,
         "oom_mb": 12,

tools/php2shell_matrix.py

@@ -47,13 +47,21 @@
 
 def arch_label() -> str:
     machine = platform.machine().lower()
-    return {"arm64": "aarch64", "x86_64": "x86_64", "amd64": "x86_64"}.get(machine, machine)
+    return {"arm64": "aarch64", "x86_64": "amd64", "amd64": "amd64"}.get(machine, machine)
 
 
 def docker(*args, capture=True, timeout=600):
     return subprocess.run(["docker", *args], capture_output=capture, text=True, timeout=timeout)
 
 
+def container_arch(name: str) -> str | None:
+    result = docker("exec", name, "uname", "-m")
+    if result.returncode != 0:
+        return None
+    return {"aarch64": "aarch64", "arm64": "aarch64",
+            "x86_64": "amd64", "amd64": "amd64"}.get(result.stdout.strip().lower())
+
+
 def wait_http(url: str, timeout: float = 30.0) -> bool:
     deadline = time.time() + timeout
     while time.time() < deadline:
@@ -93,11 +101,16 @@ def run_build(build, args) -> dict:
         docker("rm", "-f", name)
         return {"label": label, "status": "no-http"}
 
+    actual_arch = container_arch(name) or arch_label()
+    label = f"{build['key']}-bookworm-{actual_arch}"
+    print(f"[*] architecture: {actual_arch}", flush=True)
+
     cmd = [sys.executable, os.path.join(HERE, "php2shell_calibrate.py"),
            "--target", url, "--container", name,
            "--repo-dir", args.repo_dir,
            "--proof-file", proof,
-           "--distro", f"bookworm-{arch_label()}",
+           "--distro", f"bookworm-{actual_arch}",
+           "--arch", actual_arch,
            "--out-dir", PROFILES]
     if not args.full_search:
         cmd += ["--stage2-t", "406"]