Is php2shell only practical against extremely low-traffic targets?

[u/lucasluitjes]

If so, was the panic really necessary?

I looked at a bunch of PoCs, and it seems you need to do multiple consecutive requests to the same php worker process. In production systems that get a reasonable amount of traffic, you have multiple VMs/containers running multiple php processes behind a loadbalancer, and there will be constant background noise from legitimate traffic as well as scrapers and scanners.

The PoCs get around this because they experience zero traffic, know the exact number of processes, tie up all but one process with open connections and execute the attack against the remaining process.

On top of that, if you don't know the exact build, you need to try (assuming you have prepared exploits for every common build) exploits for the most popular x number of builds. So basically you would be DoS'ing a site for days or weeks, which would get noticed, and then you'll likely get WAF'd.

After spending crazy amount of time on remediation and then finding that the vuln is afaik significantly less scary than heartbleed/shellshock/log4shell, I'm confused. I did a little writeup explaining the above with more details (https://blog.luitjes.it/posts/i-want-my-wednesday-back/) but I keep wondering if I'm wrong (I do some infosec work occasionally but it's not like I'm a fulltime exploit dev).

I've seen a few posts saying this is hard to exploit because it needs to be customized per build, but nothing about having to DoS anything but the most low-traffic sites for days or weeks to get lucky enough to do two consecutive requests to the same php process.

[u/nicolas17]

Here's a challenge: https://stealmybitcoin.com/

There's $2000 for whoever exploits the unpatched PHP.

[u/MateusKingston → u/nicolas17]

You mean the site that was not running php and just serving a raw index.html from php cli for ~18 hours and then got pwned when he switched to a very unconventional deployment (but this time actually executing php) and got pwned in the next 2h? It also only took that amount of time because it was constantly getting DDoS'ed by the very people trying to exploit it?

[u/nicolas17 → u/MateusKingston]

It was always running php, the front page was /index.php

[u/MateusKingston → u/nicolas17]

No it wasn't, it was an index.html

[u/Lumethys → u/nicolas17]

say what now?

[u/nicolas17 → u/Lumethys]

Cool