(ex) Security Engineer at a (few) magic internet money exchange(s); All opinions are AI generated
香港
Joined November 2015
- Tweets3.2K
- Following1.8K
- Followers1.2K
- Likes12.7K
since i showed up on the @LiveOverflow video lol
printf '%s\n' 'PHP initializes session upload-progress state (rfc1867) while parsing multipart bodies, before RINIT. Req 1 triggers a bailout that skips session cleanup and resets the req heap, leaving the session dangling in memory. Req 2 reclaims the heap, leaks the Zend heap base via the session id and replaces a forged ref over the dangling state; cleanup destroys it and calls the array destructor which runs the command. My exploit requires display_errors=1 and display_startup_errors=1 so we can leak the heap base via an allocation error msg' | shasum -a 256
confirmed: nitter.cf/beescoitu/status/21129…
Managed to eliminate the need for my original php.ini prereqs. Now that the patch is out, the prereqs were display_errors=1 + display_startup_errors=1 for my original leak path.
I actually got my new leak technique from a public PoC on github so this is definitely public now if you know where to look :)
The caveat is that the exploit is very version/heap layout dependent - since allocation sequences vary between versions (and even different php.ini configs) i suspect you'll have to have a custom "profile" / offsets for each target separately and it's still gonna be fragile.
Managed to eliminate the need for my original php.ini prereqs. Now that the patch is out, the prereqs were display_errors=1 + display_startup_errors=1 for my original leak path.
I actually got my new leak technique from a public PoC on github so this is definitely public now if you know where to look :)
The caveat is that the exploit is very version/heap layout dependent - since allocation sequences vary between versions (and even different php.ini configs) i suspect you'll have to have a custom "profile" / offsets for each target separately and it's still gonna be fragile.
Ended up awake for the whole night banging my head against LLMs trying to make a PoC for the PHP bug that's getting published today and managed to get something working!
Pretty interesting chain. The exploit I came up with has a prereq for leaking addresses (its in php.ini, wont add details for now just in case) but i think there might be a better leak oracle that I (ermm.. gpt-5.6-sol) couldn't find.
Seems like all public PoCs are mostly (unfiltered, lol) AI slop so far..