The site is not vulnerable to PHP2Shell because it doesn't actually run any PHP code. It just serves static files. The static file handler does not call code that PHP2Shell exploits. Every request leads back to the same static page.
> (AI) "A static handler (nginx’s static path, or php_cli_server_begin_send_static) just sends bytes; it never enters the PHP request lifecycle, so php_request_startup() never runs and the Zend executor/session/multipart parser the chain needs is never initialized."
The author is trying to prove their point that PHP2Shell is hard to exploit. But it's unrealistic because PHP servers usually run PHP code at some point.
Yep. It had to add a Dockerfile to build MediaWiki using vulnerable versions but it's that, a compose file, and a Python file. To be clear it still has a lot of the limitations of the other POCs, but it does work.
The site is not vulnerable to PHP2Shell because it doesn't actually run any PHP code. It just serves static files. The static file handler does not call code that PHP2Shell exploits. Every request leads back to the same static page.
> (AI) "A static handler (nginx’s static path, or php_cli_server_begin_send_static) just sends bytes; it never enters the PHP request lifecycle, so php_request_startup() never runs and the Zend executor/session/multipart parser the chain needs is never initialized."
The author is trying to prove their point that PHP2Shell is hard to exploit. But it's unrealistic because PHP servers usually run PHP code at some point.
I had an LLM recreate this Tweet and yes, it can make an exploit without reward hacking. It took 5 minutes. https://x.com/dguido/status/2113129153293897925
so basically the OP is doing a little trolling
> I had an LLM recreate this Tweet and yes, it can make an exploit without reward hacking. It took 5 minutes.
What exactly did you "recreate"? RCE on a stock Docker image based solely on that tweet? In just five minutes? Who's trolling whom here?
Yep. It had to add a Dockerfile to build MediaWiki using vulnerable versions but it's that, a compose file, and a Python file. To be clear it still has a lot of the limitations of the other POCs, but it does work.
Does it actually use php2shell or some other known mediawiki vulnerability? Can you also do this for Wordpress for example?