No, I did. But thanks for leading with an offensive comment, makes reading the rest much more enjoyable /s
> Take a look at the php files you're shipping with your "stock" server - theyre pretty contrived, no? fatal.php? producer.php boom() str repeat X 32?
> You use that to get the constants for the RCE, but without that information you're in trouble. How transferrable are these constants? Do they work with any config changes?
Yes, they work with changes. The point is that you have to use a container to have a reproducible memory layout that you can target. And that _is_ known and _is_ reproducible.
It's not that hard to find out which OS images or which PHP version you're running on the server, there's plenty of well working scanning tools (e.g. projectdiscovery).
And this is setting aside that 99% of servers probably run standard versions of Ubuntu or Debian combined with the distribution packages of Magento, Wordpress, etc. And those are also reproducible in their memory layout, hosting setup, built package versions, etc.
Just as a disclaimer because I know where this is going: No, I didn't target muslc. Because most operating systems still don't use it, and that's the actual problem here we should discuss here.