Wrong information

[hahaSec]

Hello
My version of PHP is PHP Version 7.1.27

disable_functions：passthru,exec,system,chroot,chgrp,chown,shell_exec,proc_open,proc_get_status,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server,fsocket,popen

I uploaded exploit. PHP to the website，Execution is wrong, and the information is as follows.

Couldn't parse ELF

Can you solve it, please?

[mm0r1]

This looks like it could be caused by the php binary/library being compiled without RELRO. I have pushed a commit that addresses this issue, please pull the code and try again.

[hahaSec]

看来这可能是由于在没有RELRO的情况下编译php二进制/库引起的。我已经推送了一个致力于解决此问题的提交，请提取代码，然后重试。

I tested the error on the real target webllshell as follows


I tested it in the PHP environment of the local Windows and reported the following errors

[hahaSec]

This looks like it could be caused by the php binary/library being compiled without RELRO. I have pushed a commit that addresses this issue, please pull the code and try again.

Can you tell me what kind of test you are in?

[hahaSec]

This looks like it could be caused by the php binary/library being compiled without RELRO. I have pushed a commit that addresses this issue, please pull the code and try again.
The code used in this article was tested in Windows local PHP environment as follows
https://bugs.php.net/bug.php?id=77843

[mm0r1]

Even though it's possible to exploit this vulnerability on Windows, this PoC is for Linux x64 only, I should have clarified that.

The exploit was tested on various php7.1-7.3 builds for Ubuntu and CentOS with fpm/cli/apache2 server APIs. As stated in README, it's not guaranteed to work everywhere. I can, however, try to debug the problem if you can provide the binary that's causing issues.

Alternatively, you can try incrementing the $n_alloc variable.

[h1pwn]

php 7.2.21
Couldn't get basic_functions address

base:
4194304
elf
Array
(
    [0] => 11988256
    [1] => 5693068
    [2] => 242184
)

any ideas ?

[mm0r1]

Looks like the ELF parsing stage gives wrong results. Can you provide the php binary that's having issues with this PoC?

[mm0r1]

Fixed in b160b06.