ch00ch00, it's monday and the irresponsible disclosure train is taking off again! recycled the recent unserialize bug + 0day uaf (go fish from the video and report upstream, you will get a cookie and maybe a shiny CVE number? heheh) turn on audio for ch00nz

addressing some elephants in the room (huhu); * meant to write (@calif_io) (thats what u get for staring at shared libs all day) * this is just a sandbox escape; trying to sandbox PHP using the builtin mechanisms is 100% a bad idea (just like multi-user *nix systems ;))

I'm just picturing a SoC team finding this and being like what kind of obfuscation is that... Then they zoom out and it's an elephant... 👏

awesome. did you checkout the local/sandbox escape exploit we released with the blog? your php shell looks much more stylish also :)

I somehow missed that PoC link, not sure if my clanker missed it; only fed it the calif blogpost! told it: "go find some inspiration here for turning 'our' bug into an arb read". learnt that the unserialize() bug hasn't been plugged yet (in typical php fashion) and proceeded to use it for the infoleak part of the exploit (real 0day is a SoapServer UAF ;-)) PHP security is such a joke.. I wrote this other thing back in *looks at calendar* 2011 (original bug by @i0n1c iirc): and that can still SEGV a recent PHP 8.x (although I think it's been denominated to a NULL-deref only due to PHP architectural changes, but still lol..)

an off-topic question, what's terminal are you using? that flashly cursor looks cool!

i forgot how much i missed hax demos like this

Love it. Did you write the exploit yourself, or did Claude do it?

this is 100% claude slop with a few manual corrections. :) fun fact: if you feed claude your old SplDoublyLinkedList::offsetUnset exploit and ask it to look for variants some new SplDoublyLinkedList 0day will fall out too. ;) (PHP7 strats for exploiting don't work though, obviously)

@cfreal_ You are 100% right, they patched a UAF I reported this WE. And I’m pretty sure Claude can find a thousand more by just asking "Find UAF by looking at all ext" …

@cfreal_ hah, that is exactly the bug i stumbled over i think. ⬇️ weird stance, why have security boundaries like disable_functions and open_basedir when you’re not going to acknowledge ways that break them?

@SinSinology beautiful :)

@SinSinology thank you for taking time for the wallpaper photoshoot 🙏

@SinSinology 😭😂

I have a 600 bug backlog to go through that my LLM generated via LEAN specs. Should I just dump it public?