Conversation

The winner of the stealmybitcoin[.]com exploit challenge has a remarkably good writeup on the #PHP2Shell exploit process. The PoC clearly explains what's involved in targeting and calibration for any given PHP version/deployment.

https://github.com/KillaBoi/StealMyBitcoin-PoC/tree/main

What this tells us is exploitation requires knowledge of:

1. PHP version
2. Reasonable address spaces for the heap
3. PHP worker count
4. Exact offsets for all of the above

Blind attacks are highly likely to fail unless allowed to continue for some time.