LiveOverflow

I sent him an email. Quote:

> It was index.html but served from PHP's webserver.

OP confirmed that it wasn't exploitable, because it was not even running PHP code.

OP confirmed that the server was initially serving only an index.html. In that configuration, the vulnerable code path is never reached — it requires a .php file.

OP added php-version.php roughly 18–19 hours into the experiment (I'm not sure of the exact timing), so that period should be subtracted from the publicly displayed challenge duration.

Based on my external fingerprinting, I now believe the setup should actually be exploitable!

However, the server is being absolutely hammered with requests and crashes. Making it significantly harder to pull off. This is imo still an unrealistic target. If you are not taking the top 1% PHP websites, then they will have long periods (1 minute) of no traffic.

If someone manages to pull off a working exploit under these conditions, that would be crazy to me.

I believe it's not exploitable. People say that it's obviously easy when you know the exact config. So can you proof it's even possible? I am pretty outspoken about php2shell being realistic to exploit, so I am happy to independently verify to everybody that it is a realistic setup. You can reach me @LiveOverflow on Twitter or so.

From my raisistance.com blog 10 October 2026 00:05:56–25 October 2026 09:25:02 UTC:

- 95.3% of seconds had zero logged requests

- 11,582 of 22,159 complete minutes (52.3%) had no requests. The longest quiet stretch was 27 minutes 26 seconds.

- 3,283 continuous quiet stretches lasted at least 120 seconds. Together they totalled 225 hours 27 minutes 27 seconds—61.0% of the logged timespan.

- Excluding Apache’s internal dummy connections: 3,305 qualifying stretches totalled 227 hours 1 minute 51 seconds—61.5% of the timespan.

- Of 38,389 seconds with exactly one request, 14,692 contained an Apache ::1 internal dummy connection. Others included homepage visits, WordPress login requests, crawlers, and scanner probes.

I don't know this.

When I installed my WordPress blog with DigitalOcean template in 2023, it was Apache + mod_php.

Official WordPress docs mentions Apache before nginx: https://developer.wordpress.org/advanced-administration/serv...

Official php install instructions for Linux uses Apache + mod_php: https://www.php.net/manual/en/install.unix.debian.php

thanks you, but I don't want to use that as an excuse. The AI content is really just a reflection of what excites me right now... sorry :D

And this php2shell vulnerability perfectly hits the sweet spot for me and is one of the coolest vulns I have ever seen.

I think you missed the time where I burned the bridge to OpenAI by calling out the CISO: https://x.com/LiveOverflow/status/2101252692635004997

I wish I would be sponsored by OpenAI. I am spending way too much on subscription for it.

I am not deleting any comments ever. I just checked, YouTube held your comment as "likely spam". I accepted it now and pinned it, I always appreciate it when sb is reaching out with a reasonable comment!

It is an absolutely slopped exploit, hahaha, I fully agree. But that was exactly my point. Memory corruption exploits over the internet have been historically extremely difficult. And it took many days of building a PoC. And this is clearly different now. And of course there are a lot of practical challenges, but that does not make it unrealistic vulnerability to exploit.

> But how is it a realistic precondition to have a server in which you are the only person making requests for 30 straight seconds?

I think it's VERY realistic. My random blog from 2023 https://raisistance.com has hours or days without requests. I think a majority of (old) PHP sites barely anybody visits. And there are tons of random company or government website without any requests at night or so. Also depending on the setup, there ar methods to deal with concurrent traffic. For example Apache (see here: https://x.com/LiveOverflow/status/2113555517339480284).

I think it's clear so far that it's not mass-exploitation material. But once you are more targeted and have a random LAMP stack, it becomes very realistic.

Would you setup a random vulnerable php version from Docker image like `php:8.5.11-apache` on a server, put a flag there, and give me the IP? For me this is a realistic setup and it's fairly easy to exploit.

I didn't say it's "end of the world". I am just saying it's an insane vulnerability.

It's not easily defeated by the default setup. Quite the contrary, the default setups are great. Typical apache + mod_php is the easiest to exploit. For example:

- Docker image `php:8.5.11-apache` is easy to exploit.

- Or the WordPress blog I installed with Digital Ocean template in 2023.

dunno. Isn't LAMP a common PHP stack?

This is easy to exploit for example: `docker docker run -d --rm -p 0.0.0.0:80:80 wordpress@sha256:c96e9e9a8ead2fea02f05469b356134da45681aaefa0f961a87653d58c462794` (basically `wordpress:7.1.3-php8.5-apache` with vulnerable php version 8.5.11)

1. I dont have an AI pentesting platform.

2. This CTF is using nginx which has a `client_max_body_size=1m` limit. My exploit right now requires more, but I will give it a try (aka ask Codex).

3. You can setup a server with `docker run php:8.5.11-apache` with any of the over 400 vulnerable `php` apache images and give me the IP.

If it's nginx + fpm + "empty" index.php, it's a meme and not exploitable.

edit: looks more like nginx + cli-server. But the 1MB nginx body limit is annoying. Why is nobody setting up these CTF servers with a setup people actually say would be easy to exploit. Like a LAMP stack.

interesting! I never thought about that somebody might interpret it in this way

Do you know where I could get old IRC logs? I was looking for some but couldn't find any. I guess most of them are not archived anywhere?

IRC logs of #hack etc. would be gold!

Must be advanced because:

> Throw away your paid tools because this is some God level shit. Now with 4 hand written parsers, an intelligent payload generator, powerful fuzzing engine, DOM scanner, hidden parameter discovery and an incredibly fast crawler. F*cking retweet it!

- https://twitter.com/s0md3v/status/1061255510677057537

> Exactly, that's why you have no idea how it works and all. Well, it took me a month and being a developer of 30+ open source software, this is the first time I am saying this is some God level shit and I mean it.

- https://twitter.com/s0md3v/status/1061662698335723520

thank you for sharing my channel <3

I would also like to highlight the following other creators. For me seeing the process of others has been a lot more fruitful then just following text tutorials:

+ ippsec: https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA

+ John Hammond: https://www.youtube.com/user/RootOfTheNull

+ Gynvael EN: https://www.youtube.com/user/GynvaelEN

+ Derek Rook: https://www.youtube.com/channel/UCMACXuWd2w6_IEGog744UaA

+ ...

I create highly technical videos about various topics of IT security. Many of my videos are walk-throughs of CTF challenges explaining my thought process. I think this playlist could be interesting: https://www.youtube.com/playlist?list=PLhixgUqwRTjywPzsTYz28...

I have also recently started a series on Pwn Adventure 3, where we are hacking a game and I explain my process: https://www.youtube.com/playlist?list=PLhixgUqwRTjzzBeFSHXrw...

Besides that, I can also really recommend livestreams/screenshares from the following creators. To me, seeing how somebody really does it and where they struggle, really really helped me break through a wall I was hitting:

+ ippsec: https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA

+ John Hammond: https://www.youtube.com/user/RootOfTheNull

+ Gynvael EN: https://www.youtube.com/user/GynvaelEN

+ Derek Rook: https://www.youtube.com/channel/UCMACXuWd2w6_IEGog744UaA

+ ...

I think a difference can be made about the individual "right to be forgotten" and the transparency/accountability of a public company.

Shameless plug: https://www.youtube.com/LiveOverflowCTF not directly programming, but hopefully still interesting