It is an absolutely slopped exploit, hahaha, I fully agree. But that was exactly my point. Memory corruption exploits over the internet have been historically extremely difficult. And it took many days of building a PoC. And this is clearly different now. And of course there are a lot of practical challenges, but that does not make it unrealistic vulnerability to exploit.
> But how is it a realistic precondition to have a server in which you are the only person making requests for 30 straight seconds?
I think it's VERY realistic. My random blog from 2023 https://raisistance.com has hours or days without requests. I think a majority of (old) PHP sites barely anybody visits. And there are tons of random company or government website without any requests at night or so. Also depending on the setup, there ar methods to deal with concurrent traffic. For example Apache (see here: https://x.com/LiveOverflow/status/2113555517339480284).
I think it's clear so far that it's not mass-exploitation material. But once you are more targeted and have a random LAMP stack, it becomes very realistic.
Would you setup a random vulnerable php version from Docker image like `php:8.5.11-apache` on a server, put a flag there, and give me the IP? For me this is a realistic setup and it's fairly easy to exploit.
I think we can set up something interesting here, I'd be down to set up a little "PHP2Shell Olympics" as we change preconditions and see how well the exploits fare. I am pretty sure our opinions of "this can be exploited, and LLMs can aid a rapid exploit of previously-complex ASLR nonsense" and "it's difficult to do memory corruption over the internet; php2shell is not a log4shell moment" are mutually compatible.
My contact details are on the bottom of the blog post.
My datamining project for a game for example, that noone besides me and 2 friends use, gets thousands of requests per second, because all the AI bots found it and try to index every single page (thousands of ssr pages) and they repeat the requests when my cache-control headers expire (ie: when i consider the old page stale), so it's an endless stream (I dont mind the challenge of serving all of these at high performance xD).
My main website, in the same domain (not a subdomain), barely gets any requests, it only has the one main index page with a single link to the datamining subdomain, that's about it.
- 95.3% of seconds had zero logged requests
- 11,582 of 22,159 complete minutes (52.3%) had no requests. The longest quiet stretch was 27 minutes 26 seconds.
- 3,283 continuous quiet stretches lasted at least 120 seconds. Together they totalled 225 hours 27 minutes 27 seconds—61.0% of the logged timespan.
- Excluding Apache’s internal dummy connections: 3,305 qualifying stretches totalled 227 hours 1 minute 51 seconds—61.5% of the timespan.
- Of 38,389 seconds with exactly one request, 14,692 contained an Apache ::1 internal dummy connection. Others included homepage visits, WordPress login requests, crawlers, and scanner probes.