A few interesting things from testing the PHP2Shell PoC against Windows targets:
Getting this to work isn’t as simple as running the exploit against a vulnerable PHP version. It’s a bloody pain actually.
→ Some methods need non-default PHP settings.
→ Others require an LFI vulnerability or specific session configurations.
→ One method requires the target application to already have a PHP class that implements __wakeup() or __destruct().the method won’t work against every vulnerable application...
→ IIS, Apache, and PHP can block large requests before they reach the vulnerable code.
On IIS/FastCGI, running out of memory can kill php-cgi.exe and break the exploit. Apache/mod_php may survive, but that doesn’t guarantee RCE.
The public PoC has a ton of limitations. The vulnerability may still be serious, but reliable exploitation isn’t straightforward for windows. Linux is a lot easier.
•or I just can’t get it to work 🤷 😂 But if I can’t get it to work, other low level actors won’t be either.