⬢github Python · 1.5K ★ +650 since we first saw it · pushed 3 d ago
9bie/php2shell-bypass-aslr-exp
A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.
A Python exploit that achieves remote code execution against stock PHP/Apache setups using only plain HTTP requests, bypassing ASLR via memory-leak techniques. It works without modifying php.ini, needing no display_errors or raised memory_limit, and no custom builds. The chain exploits chunked uploads, session handling bugs, and OOB reads to leak pointers and hijack control flow, calling system() during shutdown.
Why now: It's trending on GitHub as a newly pushed, most-starred repo (832 stars in ~1 day), demoing a pure-HTTP RCE chain against fully official PHP 8.4/Apache configurations, which is notable for penetration researchers.
Who it is for: Security researchers and penetration testers studying PHP exploitation techniques and memory-corruption primitives.
Stars over our 263 snapshots: 832 to 1.5K, since 4 d ago.
Where people talked about it
- ⬢github new repos, most starred 7 min ago
- ⬢github new repos, most starred 6 h ago
- ⬢github new repos, most starred 1 d ago
- ⬢github new repos, most starred 2 d ago
- ⬢github new repos, most starred 3 d ago
- ⬢github new repos, most starred 4 d ago
API: https://socialmediatrends-api.osmike.com/v1/repos/9bie/php2shell-bypass-aslr-exp