PHP2Shell Deep Dive

I'm the one who wrote this.I originally tried submitting it here myself but without much luck so glad to see someone else shared it! Thanks for bringing it here.

also if anyone has another working PoC for that specific build I'd really appreciate if they could share it because looking at how the exploit works it does something that is not done on any other solution that i found for other builds, none of them hold the spot with a resize (key “1050” is sent twice) than make an intermediate buffer from the next field("1999") fall there.it’s the only approach I’ve seen that uses a repeated key like that.

I wonder whether there's a more direct way to achieve that as in the solutions for other builds. If there is, I think it would be interesting to compare the reliability of the different approaches based on the memory manipulation itself rather than how they reach the target

Great writeup! Go into it with time set aside to actually deep dive.

The most impressive this was chaining this exploit with another linux exploit to gain root access.

A week to go down in history.