YHK - yet another hacker news clone

Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers

26 points 882542F3884314B 2 hours ago 9 comments

tensegrist 48 minutes ago | parent

perhaps i was wrong

https://news.ycombinator.com/item?id=50272530

rkozik1989 38 minutes ago | parent

Yes, you were. These exploits are happening in processes like php-fpm before it actually executes any code for the web application, so its not like you need to find endpoint where a specific class is being invoked or anything like that.

Vaushite 27 minutes ago | parent

Extremely wrong. I'm not sure how "RCE on every PHP server, from anywhere on the internet, no other requirements" could possibly be underblown by anyone. Exploiting the PHP request parser bypasses basically all security checks and it doesn't matter how secure your code is because the exploitable component runs before your code and can't be disabled.

I am very curious to hear why you thought it was overblown.

There was also that other guy who posted "steal my bitcoin" on a vulnerable PHP server with the private keys to prove it was overblown, and got his bitcoin stolen within a day.

jstanley 14 minutes ago | parent

> I'm not sure how "RCE on every PHP server, from anywhere on the internet, no other requirements" could possibly be underblown by anyone

It could be overblown if it's not true. The amount of time it took for anyone to claim the Bitcoin from the supposedly-vulnerable PHP site convinced a lot of people that the vulnerability was not as bad as claimed.

tkz1312 2 minutes ago | parent

wasn't it setup in an unexploitable configuration (not actually serving a php page IIRC?) for most of the time, and then got popped within like 2 hours once fixed?

1718627440 13 minutes ago | parent

> I am very curious to hear why you thought it was overblown.

Not having made the claim (took down my website too), but because PHP is not connected directly to the network. While you cannot prevent PHP from being overtaken from inside the PHP program, you can prevent PHP being executed on malicious data by configuring the webserver. It's overblown in the sense that it would be even more serious if the same happened in the webserver itself.

aaomidi 7 minutes ago | parent

I commend you to having corrected your thoughts this publicly fwiw.

We need more of this.

lunargamma676 42 minutes ago | parent

Same here, though what stuck with me is that a firewall's admin PHP page was reachable from the internet at all, keep that on a mgmt VLAN.

athrowaway3z 8 minutes ago | parent

> A1 — Memory Exhaustion (~383MB):

I'm actually somewhat surprised at the clumsiness here.

I'm a complete amateur that had DeepSeek build a PHP2Shell exploit, and once the stealmybitcoin site went up and set an upload limit, i had DeepSeek try to shrink/amplify it.

DeepSeek couldn't find anything but a 2x reduction, but reading the report of how it was done - https://github.com/KillaBoi/StealMyBitcoin-PoC - I was somewhat surprised it didn't find it, and equally horrified at PHP allowing such a memory bomb of creating nested objects by parsing `f[0][x][x]...` from random requests.

Point being; these aren't amateurs but i kind of expect most well funded pros to have found this method to avoid sending massive filenames and session progress data.