mirror of
https://github.com/BaaRai/ARTEX.git
synced 2026-11-15 04:30:55 +08:00
BaaRai
750f4eb091
Implements #109. Skills ship the chain-1 workflow (session file injection through upload_progress filename + app LFI -> RCE, CVE-2026-109618/109619) with hard gates: authorized targets only, program zero-day policy checked before any live attempt (patches landed 2026-10-21 for 8.2-8.5), passive detection before exploitation, lab-first practice via the vendored docker lab, chains 2/3 (UAF, serializer mismatch) marked lab-only, one-shot verification with a marker. Upstream PoCs vendored under scripts/poc/php2shell with attribution and the MIT notice (upstream declares MIT in its README).
64 lines
3.5 KiB
Markdown
64 lines
3.5 KiB
Markdown
---
|
|
name: php2shell
|
|
description: "Invoke this skill when a task holds an LFI/file-inclusion finding on a PHP target (or needs to assess one) and the target may run PHP 5.4-8.5.11 with default session.upload_progress settings: turns a read-only LFI into verified RCE via the session-file-injection chain (CVE-2026-109618/109619), lab-first and gated by program policy. Also covers passive detection of the vulnerable configuration."
|
|
---
|
|
|
|
# php2shell: session.upload_progress LFI-to-RCE (CVE-2026-109618/109619)
|
|
|
|
Under an **authorized** engagement only. This skill upgrades an existing
|
|
LFI/unsafe-include finding on a PHP target into RCE, or classifies the target
|
|
as not affected, using the vendored PoCs under `scripts/poc/php2shell/`
|
|
(upstream: ikow/php2shell-poc, MIT; see the LICENSE there).
|
|
|
|
## Hard gates (read before touching any target)
|
|
|
|
1. **Authorization**: the target must be inside the task's authorized scope.
|
|
2. **Program policy first**: many programs exclude or do not pay for
|
|
recently-patched third-party/framework zero-days within ~14 days of the
|
|
patch release. PHP patched these in 8.2.35/8.3.36/8.4.27/8.5.12
|
|
(2026-10-21). CHECK the program's policy on component zero-days BEFORE
|
|
testing a live target, and reflect the policy in how the finding is claimed
|
|
(often "reportable, not payable" or payable only after the clause lapses).
|
|
3. **Detection before exploitation**: fingerprint passively first (response
|
|
headers, error pages, X-Powered-By). Only targets on PHP 5.4.0-8.5.11
|
|
(any build with session.upload_progress enabled, the default) are
|
|
candidates.
|
|
4. **Lab first**: run chain 1 against the local lab (`lab/setup.sh` builds a
|
|
vulnerable PHP 8.2 FPM+nginx environment) until the mechanism is
|
|
understood, then one-shot the authorized target.
|
|
5. **Chains 2 and 3 (var_destroy UAF, serializer mismatch) are LAB-ONLY**:
|
|
never fire memory-corruption or serializer-confusion primitives at a
|
|
remote target. Detection of their preconditions is fine.
|
|
6. **One-shot verification** on the target: prove execution once (a marker
|
|
echo), capture evidence, stop. No persistence, no further exploration
|
|
through the shell.
|
|
|
|
## Chain 1 workflow (session file injection + LFI -> RCE)
|
|
|
|
1. Start with the task's LFI finding: note the include path parameter and its
|
|
constraints (prefix/suffix, truncation, wrapper filters).
|
|
2. Confirm the session path is reachable through that LFI: with
|
|
`session.upload_progress.enabled=On` (default), an in-flight multipart POST
|
|
with an attacker-named file field writes a session file under the session
|
|
save path containing the raw filename.
|
|
3. Inject PHP into the uploaded **filename** (not the file content):
|
|
`verify_session_injection.py` demonstrates the full mechanics (session
|
|
fixation via POST body PHPSESSID, raw filename storage, inclusion).
|
|
4. Race the session file's lifetime: include it through the LFI while the
|
|
upload is still in flight (or keep the upload connection open).
|
|
5. Verify RCE with a single marker command; record the request sequence as
|
|
evidence.
|
|
|
|
## Detection without an LFI
|
|
|
|
The chains need an app-level file-inclusion primitive; without one the
|
|
configuration is hardening-relevant, not exploitable. Report posture only.
|
|
|
|
## Vendored artifacts
|
|
|
|
- `poc/verify_session_injection.py` - chain 1 end-to-end against a lab URL
|
|
- `poc/verify_handler_mismatch.py` - chain 3 (lab only)
|
|
- `poc/verify_uaf_asan.php` - chain 2 under an ASAN PHP build (lab only)
|
|
- `lab/setup.sh` - builds the vulnerable docker lab locally
|
|
- `docs/ANALYSIS.md`, `README.upstream.md` - the upstream technical writeup
|