Member-only story
PHP2Shell TryHackMe Walkthrough by Arafat Ashrafi Talha
Exploit the PHP2Shell runtime CVEs via session.upload_progress for unauthenticated RCE.
Every vulnerability abuses something that was built to be useful, and this one is no exception. Before looking at the bug, it is worth understanding the feature it stands on, because the feature is where the attacker’s reach comes from.
When a browser uploads a large file, the server has no simple way to tell the page how far the upload has got. PHP solves this with a feature called session.upload_progress. While PHP is still reading a multipart/form-data request body off the wire, it writes a running description of the upload, its name, its size and how many bytes have arrived so far, into the user's $_SESSION. A second request can then read that session data and report progress back to the browser. The feature is enabled by default, and it is switched on for a given upload by including a form field whose name matches the session.upload_progress.name setting, which defaults to PHP_SESSION_UPLOAD_PROGRESS.
The detail that matters is when this happens. Parsing the request body is one of the first things PHP does, long before it initialises the…
