I sent him an email. Quote:
> It was index.html but served from PHP's webserver.
325 karma · joined December 12, 2015
> It was index.html but served from PHP's webserver.
OP added php-version.php roughly 18–19 hours into the experiment (I'm not sure of the exact timing), so that period should be subtracted from the publicly displayed challenge duration.
Based on my external fingerprinting, I now believe the setup should actually be exploitable!
However, the server is being absolutely hammered with requests and crashes. Making it significantly harder to pull off. This is imo still an unrealistic target. If you are not taking the top 1% PHP websites, then they will have long periods (1 minute) of no traffic.
If someone manages to pull off a working exploit under these conditions, that would be crazy to me.
- 95.3% of seconds had zero logged requests
- 11,582 of 22,159 complete minutes (52.3%) had no requests. The longest quiet stretch was 27 minutes 26 seconds.
- 3,283 continuous quiet stretches lasted at least 120 seconds. Together they totalled 225 hours 27 minutes 27 seconds—61.0% of the logged timespan.
- Excluding Apache’s internal dummy connections: 3,305 qualifying stretches totalled 227 hours 1 minute 51 seconds—61.5% of the timespan.
- Of 38,389 seconds with exactly one request, 14,692 contained an Apache ::1 internal dummy connection. Others included homepage visits, WordPress login requests, crawlers, and scanner probes.
When I installed my WordPress blog with DigitalOcean template in 2023, it was Apache + mod_php.
Official WordPress docs mentions Apache before nginx: https://developer.wordpress.org/advanced-administration/serv...
Official php install instructions for Linux uses Apache + mod_php: https://www.php.net/manual/en/install.unix.debian.php
And this php2shell vulnerability perfectly hits the sweet spot for me and is one of the coolest vulns I have ever seen.
I wish I would be sponsored by OpenAI. I am spending way too much on subscription for it.
It is an absolutely slopped exploit, hahaha, I fully agree. But that was exactly my point. Memory corruption exploits over the internet have been historically extremely difficult. And it took many days of building a PoC. And this is clearly different now. And of course there are a lot of practical challenges, but that does not make it unrealistic vulnerability to exploit.
> But how is it a realistic precondition to have a server in which you are the only person making requests for 30 straight seconds?
I think it's VERY realistic. My random blog from 2023 https://raisistance.com has hours or days without requests. I think a majority of (old) PHP sites barely anybody visits. And there are tons of random company or government website without any requests at night or so. Also depending on the setup, there ar methods to deal with concurrent traffic. For example Apache (see here: https://x.com/LiveOverflow/status/2113555517339480284).
I think it's clear so far that it's not mass-exploitation material. But once you are more targeted and have a random LAMP stack, it becomes very realistic.
Would you setup a random vulnerable php version from Docker image like `php:8.5.11-apache` on a server, put a flag there, and give me the IP? For me this is a realistic setup and it's fairly easy to exploit.
It's not easily defeated by the default setup. Quite the contrary, the default setups are great. Typical apache + mod_php is the easiest to exploit. For example:
- Docker image `php:8.5.11-apache` is easy to exploit.
- Or the WordPress blog I installed with Digital Ocean template in 2023.
This is easy to exploit for example: `docker docker run -d --rm -p 0.0.0.0:80:80 wordpress@sha256:c96e9e9a8ead2fea02f05469b356134da45681aaefa0f961a87653d58c462794` (basically `wordpress:7.1.3-php8.5-apache` with vulnerable php version 8.5.11)
2. This CTF is using nginx which has a `client_max_body_size=1m` limit. My exploit right now requires more, but I will give it a try (aka ask Codex).
3. You can setup a server with `docker run php:8.5.11-apache` with any of the over 400 vulnerable `php` apache images and give me the IP.
edit: looks more like nginx + cli-server. But the 1MB nginx body limit is annoying. Why is nobody setting up these CTF servers with a setup people actually say would be easy to exploit. Like a LAMP stack.
IRC logs of #hack etc. would be gold!
> Throw away your paid tools because this is some God level shit. Now with 4 hand written parsers, an intelligent payload generator, powerful fuzzing engine, DOM scanner, hidden parameter discovery and an incredibly fast crawler. F*cking retweet it!
- https://twitter.com/s0md3v/status/1061255510677057537
> Exactly, that's why you have no idea how it works and all. Well, it took me a month and being a developer of 30+ open source software, this is the first time I am saying this is some God level shit and I mean it.
I would also like to highlight the following other creators. For me seeing the process of others has been a lot more fruitful then just following text tutorials:
+ ippsec: https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA
+ John Hammond: https://www.youtube.com/user/RootOfTheNull
+ Gynvael EN: https://www.youtube.com/user/GynvaelEN
+ Derek Rook: https://www.youtube.com/channel/UCMACXuWd2w6_IEGog744UaA
+ ...
I have also recently started a series on Pwn Adventure 3, where we are hacking a game and I explain my process: https://www.youtube.com/playlist?list=PLhixgUqwRTjzzBeFSHXrw...
Besides that, I can also really recommend livestreams/screenshares from the following creators. To me, seeing how somebody really does it and where they struggle, really really helped me break through a wall I was hitting:
+ ippsec: https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA
+ John Hammond: https://www.youtube.com/user/RootOfTheNull
+ Gynvael EN: https://www.youtube.com/user/GynvaelEN
+ Derek Rook: https://www.youtube.com/channel/UCMACXuWd2w6_IEGog744UaA
+ ...
And like the other people responded, there are just wayyyy to many primes to make that feasible. Though it is a common Challenge in security competitions to find the factors to a public key through factordb. Or having two bad keys sharing one same prime - then you can use Euclidean algorithm (greates common divisor).
To be honest with you? I consider that sentence almost offensive. I hear you, but I think you have absolutely wrong expectations. You want to learn something that is not a profession like plumber where a really good expert can teach you everything you need to know with all the little tricks learned over the years. The field is sooo huge diverse and complicated that this won't work. And I think my playlist offers a rough outline that you can follow, but without going down rabbit holes left and right, and getting stuck many many times, you wont become good at it.
I understand the frustration that you don't want to "waste time" and that you are busy already. But everybody I know who is good in this field, including my own experience shows me, that nobody learns this stuff through a straight path. And everybody knows that most of the time will be spent chasing rabbits through a labyrinth and getting stuck.
Also there is no clear path. It's a complicated web you have to learn to traverse. For example like "Learn C" - what the f* does that even mean? To what extend? Hello World? Drivers? Or Operating System? "Learn assembler" - which assembler? have you looked into the Intel Instruction spec once? I doubt any human knows every instruction. Also who said that intel is the way to go, why not ARM or AVR. All of these fields offer a lifetime of studying in itself.
The "art" in becoming good at security and RE is to get a broad knowledge of a lot of things and try to simultaneously go deeper 'n deeper in all of them. And if you are interested in a specific field, put more weight on those topics.
You know how long it takes to reverse engineer something? People stare on IDA for weeks or months at a time. You can't learn RE just by reading a book or a blog. You gotta start to just doing it, and hopefully find a few blogs and people to keep up the spirit.
Quickly looking over the code I think you use a slightly different way to achieve the r/w than qwerty - you don't misalign a pointer, correct? Can you give a short description how you do it?
I wondered how to not crash the switch when done, and you seem to simply set everything to 0 `this.bufs[i] = 0;` and that solves that issue. Could you say a few words on why that is the case?
Any information yet you want to share about the execution environment? Is there some kind of sandbox? Anything interesting you can already access, or surprisingly not access?
Edit: One more question. Did you guys get to play any BotW yet? :D
I really love the overengineering of this toolkit <3
My job title is "Penetration tester" but I don't fall into that category. That's why I often refer to it as doing "application security analysis/audits". My current job is to do black/white box testing of single applications - and not a huge organisations where you just phish some employees. I have not worked for other companies, but as far as I can tell, many "penetration testing jobs" are actually what I do.
It's fun, challenging and very technical. And obviously no scanners are used - I have never in my career used nessus or any other click2exploit tool.