martinpham

First of all, thanks to KillaBoi for his great work!

For days I was reading many threads saying that PHP2Shell is very hard to exploit, with no working public PoC available. Honestly, I patched my servers but had no way to verify if the patches actually worked. And ecently, reading the PoC from KillaBoi gave me the idea to make it easier to verify my servers, so I wanted to share it here with you: https://github.com/MartinPham/php2shell-poc

The exploit requires some specific information to work, like the PHP version, the binary's properties (how it was built, optimizations, etc.) and the runtime configuration. Yes, you can hide these from others, but anyone who knows the Docker image or PHP build can calculate the exact values needed to exploit your servers.

The repository contains:

- The Lab (compose.yml + lab/): a PHP/nginx setup to test against (nginx and PHP versions are not exposed to the client)

- poc.py: a single self-contained script that both calculates the needed values from a Docker image and runs the exploit against the target

I decided to make this public because others will find a way to exploit it anyway, so please patch your servers now.

Thanks! For logo I'd prefer a colored logo than black/white, however you could try to change the dot colors to grey while using with black/white logo. Emojis can be tricky because they often have subtle gradients or low contrast against the QR patterns, I'm gonna look at those cases right now!

SmartContract UI is an open source tool that helps you to interact with any Smart contract. - Discover millions deployed Smart Contracts across over 260 blockchains. - Easy to read and write Smart Contract's data with a friendly UI. - Sign your request in many ways: with Browser using Metamask Wallet, Binance Wallet, or with TrustWallet's WalletConnect protocol, Coinbase's WalletLink protocol, or importing your wallet from key. - Offline-First: You can use it anywhere, even without a network connection.

- Disuzz is an open source comment system, that you can embed in your website to increase reader engagement, grow audience and traffic.

- Supporting Firestore as the data storage, with Realtime and Offline support. You can use Discuzz easily without any backend server.

- With Firebase Auth support, you can provide many ways to authenticate for your users.

- You can easily config the access control, to adjust permissions (Example: open to all people, or only authenticated users, or you can also turn on moderation mode for every comments)

- Customizable theme, with built-in light/dark theme.

It supports many ways to import the ABI (from URL, uploaded file, or from deployed contract). You can choose how to sign the request (Browser wallet like Metamask, WalletConnect, or using keys)