Repository navigation
Expand file tree
/
Copy pathindex.html
More file actions
1101 lines (1030 loc) · 65.4 KB
/
Copy pathindex.html
File metadata and controls
1101 lines (1030 loc) · 65.4 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html lang="id">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>php2shell — Unauthenticated RCE Toolkit untuk PHP 5.4 - 8.4.26 (CVE-2026-109619)</title>
<!-- SEO Meta Tags -->
<meta name="description" content="Toolkit riset dan reproduksi unauthenticated RCE chain untuk CVE-2026-109619 & CVE-2026-109618 pada mod_php + Apache prefork. Pure HTTP, zero target-side requirements, proof-of-access design.">
<meta name="keywords" content="php2shell, CVE-2026-109619, CVE-2026-109618, PHP RCE, Apache prefork, security research, JA3 impersonation, proof-of-access, vulnerability reproduction">
<meta name="author" content="aarsaputra">
<meta name="robots" content="index, follow">
<meta name="google-site-verification" content="xGq6qtwqBFBNZWneTyzQPAYPY1Ltw0Y5uQDA5hYF5Ao">
<link rel="canonical" href="https://aarsaputra.github.io/php2shell/">
<!-- Open Graph Meta Tags -->
<meta property="og:title" content="php2shell — Unauthenticated RCE Toolkit untuk PHP 5.4 - 8.4.26">
<meta property="og:description" content="Riset & reproduksi remote exploit chain CVE-2026-109619 (CVSS 9.2). Pure HTTP, proof-of-access by design, stealth JA3 transport.">
<meta property="og:type" content="website">
<meta property="og:url" content="https://aarsaputra.github.io/php2shell/">
<meta property="og:image" content="../gambar/screenshot_1.png">
<meta property="og:site_name" content="php2shell">
<meta property="og:locale" content="id_ID">
<!-- Twitter Card Meta Tags -->
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:title" content="php2shell — Unauthenticated RCE Toolkit untuk PHP 5.4 - 8.4.26">
<meta name="twitter:description" content="Riset & reproduksi remote exploit chain CVE-2026-109619 (CVSS 9.2). Pure HTTP, proof-of-access by design, stealth JA3 transport.">
<meta name="twitter:image" content="../gambar/screenshot_1.png">
<!-- Structured Data (JSON-LD) -->
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "SoftwareSourceCode",
"name": "php2shell",
"description": "Toolkit riset dan reproduksi unauthenticated RCE chain untuk CVE-2026-109619 & CVE-2026-109618 pada mod_php + Apache prefork.",
"codeRepository": "https://github.com/aarsaputra/php2shell",
"programmingLanguage": "PHP+Python",
"license": "GPL-3.0",
"author": {
"@type": "Person",
"name": "aarsaputra"
},
"runtimePlatform": "Linux"
}
</script>
<!-- Favicon SVG (Self-contained Data URI) -->
<link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='%2300ff88'%3E%3Cpath d='M12 2C6.48 2 2 6.48 2 12c0 3.32 1.62 6.26 4.1 8.08V22h3.9v-2h4v2h3.9v-1.92c2.48-1.82 4.1-4.76 4.1-8.08 0-5.52-4.48-10-10-10zm-3 12c-.83 0-1.5-.67-1.5-1.5S8.17 11 9 11s1.5.67 1.5 1.5S9.83 14 9 14zm6 0c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5 1.5.67 1.5 1.5-.67 1.5-1.5 1.5z'/%3E%3C/svg%3E">
<!-- Critical CSS Inlined for Instant FCP & Zero Render-Blocking -->
<style>
:root{--bg-black:#05080c;--bg-primary:#0a0e14;--bg-secondary:#0f141c;--bg-card:rgba(15,21,30,0.78);--bg-card-hover:rgba(20,29,42,0.92);--bg-code:#06090e;--accent-green:#00ff88;--accent-green-glow:rgba(0,255,136,0.4);--accent-green-dim:rgba(0,255,136,0.12);--accent-green-border:rgba(0,255,136,0.28);--accent-cyan:#00e5ff;--accent-cyan-glow:rgba(0,229,255,0.4);--accent-cyan-dim:rgba(0,229,255,0.12);--accent-cyan-border:rgba(0,229,255,0.28);--accent-amber:#ffb700;--accent-amber-dim:rgba(255,183,0,0.12);--accent-red:#ff3366;--accent-red-dim:rgba(255,51,102,0.15);--text-primary:#e6edf3;--text-secondary:#8b949e;--text-muted:#586069;--text-dim:#30363d;--border-subtle:#1f2937;--border-card:rgba(0,255,136,0.15);--font-mono:ui-monospace,'JetBrains Mono','Fira Code','Cascadia Code',Menlo,Consolas,'Liberation Mono','Courier New',monospace;--font-sans:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Oxygen,Ubuntu,Cantarell,sans-serif;--transition-fast:0.15s ease;--transition-normal:0.25s cubic-bezier(0.16,1,0.3,1);--radius-sm:4px;--radius-md:8px;--radius-lg:12px}
*,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
html{scroll-behavior:smooth;font-size:16px;background-color:var(--bg-black);color:var(--text-primary);font-family:var(--font-sans);line-height:1.6;overflow-x:hidden;-webkit-font-smoothing:antialiased}
body{position:relative;background-color:var(--bg-primary);min-height:100vh;overflow-x:hidden}
h1,h2,h3,h4,h5,h6{font-family:var(--font-mono);color:var(--text-primary);line-height:1.25;letter-spacing:-0.02em}
code,pre,.font-mono{font-family:var(--font-mono)}
pre{overflow-x:auto;max-width:100%}
a{color:var(--accent-cyan);text-decoration:none;transition:color var(--transition-fast)}
a:hover{color:var(--accent-green);text-decoration:underline}
.container{width:100%;max-width:1200px;margin:0 auto;padding:0 1.5rem}
.text-green{color:var(--accent-green)}
.text-cyan{color:var(--accent-cyan)}
.text-amber{color:var(--accent-amber)}
.text-red{color:var(--accent-red)}
.text-muted{color:var(--text-secondary)}
.glow-green{text-shadow:0 0 12px var(--accent-green-glow)}
.glow-cyan{text-shadow:0 0 12px var(--accent-cyan-glow)}
.badge{display:inline-flex;align-items:center;gap:0.4rem;padding:0.25rem 0.65rem;font-family:var(--font-mono);font-size:0.78rem;font-weight:600;border-radius:var(--radius-sm);letter-spacing:0.03em;text-transform:uppercase;border:1px solid transparent}
.badge-green{background:var(--accent-green-dim);color:var(--accent-green);border-color:var(--accent-green-border)}
.badge-cyan{background:var(--accent-cyan-dim);color:var(--accent-cyan);border-color:var(--accent-cyan-border)}
.badge-red{background:var(--accent-red-dim);color:var(--accent-red);border-color:rgba(255,51,102,0.4)}
.badge-amber{background:var(--accent-amber-dim);color:var(--accent-amber);border-color:rgba(255,183,0,0.35)}
.site-header{position:sticky;top:0;z-index:100;background:rgba(10,14,20,0.88);backdrop-filter:blur(12px);-webkit-backdrop-filter:blur(12px);border-bottom:1px solid rgba(0,255,136,0.15);box-shadow:0 4px 20px rgba(0,0,0,0.4)}
.nav-wrap{display:flex;align-items:center;justify-content:space-between;height:4.2rem}
.brand-logo{display:flex;align-items:center;gap:0.75rem;font-family:var(--font-mono);font-size:1.15rem;font-weight:700;color:#fff;letter-spacing:0.05em;text-decoration:none}
.brand-icon{width:32px;height:32px;fill:var(--accent-green);filter:drop-shadow(0 0 8px var(--accent-green-glow))}
.brand-tag{font-size:0.7rem;padding:0.15rem 0.4rem;background:rgba(0,255,136,0.15);border:1px solid var(--accent-green-border);color:var(--accent-green);border-radius:var(--radius-sm)}
.nav-links{display:flex;align-items:center;gap:1.5rem;list-style:none}
.nav-link{font-family:var(--font-mono);font-size:0.88rem;color:var(--text-secondary);transition:all var(--transition-fast);padding:0.4rem 0.2rem;position:relative}
.nav-link:hover,.nav-link.active{color:var(--accent-green);text-decoration:none}
.nav-link.active::after{content:'';position:absolute;bottom:-4px;left:0;right:0;height:2px;background:var(--accent-green);box-shadow:0 0 8px var(--accent-green)}
.nav-actions{display:flex;align-items:center;gap:0.75rem}
.btn-github{display:inline-flex;align-items:center;gap:0.5rem;padding:0.5rem 1rem;background:rgba(255,255,255,0.05);border:1px solid var(--border-subtle);border-radius:var(--radius-md);color:var(--text-primary);font-family:var(--font-mono);font-size:0.85rem;font-weight:500;transition:all var(--transition-fast)}
.btn-github:hover{background:rgba(0,255,136,0.1);border-color:var(--accent-green-border);color:var(--accent-green);text-decoration:none;box-shadow:0 0 15px rgba(0,255,136,0.2)}
.mobile-menu-btn{display:none;background:transparent;border:1px solid var(--border-subtle);color:var(--text-primary);padding:0.5rem;border-radius:var(--radius-sm);cursor:pointer}
.hero-section{padding:4.5rem 0 3.5rem;position:relative}
.hero-content{text-align:center;max-width:860px;margin:0 auto 3rem}
.hero-meta-badges{display:flex;align-items:center;justify-content:center;flex-wrap:wrap;gap:0.6rem;margin-bottom:1.5rem}
.hero-title{font-size:clamp(2.2rem,5vw,3.8rem);font-weight:800;letter-spacing:-0.03em;margin-bottom:1.25rem;line-height:1.15}
.hero-title span.glitch{position:relative;display:inline-block;color:#fff}
@media(min-width:768px){.hero-title span.glitch{text-shadow:0 0 20px var(--accent-green-glow)}}
.hero-subtitle{font-size:clamp(1rem,2vw,1.25rem);color:var(--text-secondary);line-height:1.6;margin-bottom:2rem;font-weight:400}
.hero-actions{display:flex;align-items:center;justify-content:center;flex-wrap:wrap;gap:1rem;margin-bottom:2rem}
.btn{display:inline-flex;align-items:center;justify-content:center;gap:0.5rem;padding:0.75rem 1.5rem;font-family:var(--font-mono);font-size:0.95rem;font-weight:600;border-radius:var(--radius-md);cursor:pointer;transition:all var(--transition-fast);border:1px solid transparent}
.btn-primary{background:var(--accent-green);color:#06090e;box-shadow:0 0 20px var(--accent-green-glow)}
.btn-primary:hover{background:#33ff9f;box-shadow:0 0 30px rgba(0,255,136,0.6);color:#000;text-decoration:none}
.btn-secondary{background:rgba(15,21,30,0.85);border-color:var(--border-subtle);color:var(--text-primary)}
.btn-secondary:hover{background:rgba(20,29,42,1);border-color:var(--accent-cyan-border);color:var(--accent-cyan);text-decoration:none;box-shadow:0 0 15px rgba(0,229,255,0.2)}
.stats-ribbon{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:1rem;margin-top:2rem}
.stat-item{background:var(--bg-card);border:1px solid var(--border-card);border-radius:var(--radius-md);padding:1.25rem 1rem;text-align:center;transition:all var(--transition-normal)}
.stat-value{font-family:var(--font-mono);font-size:1.6rem;font-weight:800;color:var(--accent-green);margin-bottom:0.25rem}
.stat-label{font-size:0.8rem;color:var(--text-secondary);font-family:var(--font-mono);letter-spacing:0.05em;text-transform:uppercase}
.terminal-window{background:var(--bg-card);border:1px solid var(--border-card);border-radius:var(--radius-lg);box-shadow:0 12px 32px rgba(0,0,0,0.5);max-width:100%;overflow:hidden;margin-top:2.5rem}
.terminal-header{display:flex;align-items:center;justify-content:space-between;padding:0.75rem 1rem;background:#0d121a;border-bottom:1px solid #1a2230}
.terminal-controls{display:flex;gap:0.45rem}
.terminal-dot{width:12px;height:12px;border-radius:50%}
.dot-red{background:#ff5f56}.dot-yellow{background:#ffbd2e}.dot-green{background:#27c93f}
.terminal-title{font-family:var(--font-mono);font-size:0.8rem;color:var(--text-secondary);display:flex;align-items:center;gap:0.4rem}
.terminal-actions{display:flex;align-items:center;gap:0.5rem}
.terminal-btn{background:transparent;border:1px solid var(--border-subtle);color:var(--text-secondary);padding:0.2rem 0.5rem;border-radius:var(--radius-sm);font-family:var(--font-mono);font-size:0.72rem;cursor:pointer;transition:all var(--transition-fast)}
.terminal-body{padding:1.25rem 1.5rem;background:#080c14;font-family:var(--font-mono);font-size:clamp(0.72rem,1.5vw,0.86rem);line-height:1.35;min-height:340px;max-height:520px;overflow-y:auto;overflow-x:auto;-webkit-overflow-scrolling:touch;color:#c9d1d9;letter-spacing:0;font-variant-ligatures:none;font-kerning:none}
.terminal-prompt-line{display:flex;align-items:flex-start;gap:0.5rem;margin-bottom:0.75rem;font-family:var(--font-mono);font-size:clamp(0.72rem,1.5vw,0.86rem);line-height:1.35;letter-spacing:0;font-variant-ligatures:none;font-kerning:none}
.prompt-sym{color:var(--accent-green);font-weight:bold;user-select:none}
.prompt-text{color:#fff;font-weight:500;word-break:break-all}
.typing-cursor{display:inline-block;width:8px;height:1.1em;background:var(--accent-green);margin-left:2px;vertical-align:text-bottom;animation:blink 1s infinite}
@keyframes blink{0%,49%{opacity:1}50%,100%{opacity:0}}
.terminal-output{text-align:left;color:var(--text-secondary);font-family:var(--font-mono);font-size:clamp(0.72rem,1.5vw,0.86rem);line-height:1.35;overflow-x:auto;letter-spacing:0;font-variant-ligatures:none;font-kerning:none}
.terminal-output pre.line-banner,.terminal-output .line-banner,pre.line-banner{text-align:left;color:#f0f6fc;font-family:var(--font-mono);white-space:pre;margin:0 0 0.5rem 0;padding:0;background:transparent;border:none;line-height:1.35;font-size:clamp(0.72rem,1.5vw,0.86rem);letter-spacing:0;font-variant-ligatures:none;font-kerning:none}
.figlet-cyan,.terminal-output .figlet-cyan,pre.line-banner .figlet-cyan{color:#00ffff}
.figlet-blue,.terminal-output .figlet-blue,pre.line-banner .figlet-blue{color:#0087ff}
.figlet-magenta,.terminal-output .figlet-magenta,pre.line-banner .figlet-magenta{color:#d75fff}
.terminal-output .line-info,.line-info{color:var(--accent-cyan);white-space:pre;font-family:var(--font-mono);font-size:clamp(0.72rem,1.5vw,0.86rem);line-height:1.35}
.terminal-output .line-success,.line-success{color:var(--accent-green);font-weight:bold;white-space:pre;font-family:var(--font-mono);font-size:clamp(0.72rem,1.5vw,0.86rem);line-height:1.35}
.terminal-output .line-alert,.line-alert{color:var(--accent-amber);white-space:pre;font-family:var(--font-mono);font-size:clamp(0.72rem,1.5vw,0.86rem);line-height:1.35}
@media (max-width:767px){
.scanlines-overlay,.cyber-grid{display:none!important}
.site-header{backdrop-filter:none!important;-webkit-backdrop-filter:none!important;background:#0a0e14!important}
.hero-title span.glitch{text-shadow:none!important}
.glow-green,.glow-cyan{text-shadow:none!important}
.btn-primary{box-shadow:none!important}
.terminal-window{box-shadow:0 6px 18px rgba(0,0,0,0.4)}
.nav-links{display:none;position:absolute;top:4.2rem;left:0;right:0;background:#0d121a;flex-direction:column;padding:1.25rem 1.5rem;border-bottom:1px solid var(--accent-green-border);gap:0.75rem;box-shadow:0 10px 25px rgba(0,0,0,0.5);z-index:999}
.nav-links.open{display:flex}
.mobile-menu-btn{display:block}
.hero-section{padding:3rem 0 2rem}
.hero-title{font-size:clamp(1.8rem,6vw,2.8rem)}
.hero-subtitle{font-size:clamp(0.95rem,2.5vw,1.1rem)}
.stats-ribbon{grid-template-columns:repeat(2,1fr)}
.container{padding:0 1.25rem}
}
@media (max-width:480px){
.hero-section{padding:2.25rem 0 1.5rem}
.hero-title{font-size:clamp(1.45rem,6.5vw,1.85rem);line-height:1.2}
.hero-subtitle{font-size:clamp(0.85rem,3.8vw,0.95rem)}
.hero-actions{flex-direction:column;width:100%;gap:0.75rem}
.hero-actions .btn{width:100%;justify-content:center}
.container{padding:0 1rem}
}
@media (prefers-reduced-motion:reduce){
.scanlines-overlay,.cyber-grid{display:none!important}
.typing-cursor{animation:none!important;opacity:1!important}
.hero-title span.glitch,.glow-green,.glow-cyan{text-shadow:none!important}
*{scroll-behavior:auto!important;transition-duration:0.01ms!important}
}
</style>
<!-- Non-blocking Full Stylesheet Loading -->
<link rel="preload" href="style.css" as="style" onload="this.onload=null;this.rel='stylesheet'">
<noscript><link rel="stylesheet" href="style.css"></noscript>
</head>
<body>
<!-- Visual FX: Scanlines & Matrix Grid -->
<div class="scanlines-overlay" aria-hidden="true"></div>
<div class="cyber-grid" aria-hidden="true"></div>
<!-- Header & Navigation -->
<header class="site-header">
<div class="container nav-wrap">
<a href="#" class="brand-logo" title="php2shell Toolkit">
<svg class="brand-icon" viewBox="0 0 24 24">
<path d="M12 2C6.48 2 2 6.48 2 12c0 3.32 1.62 6.26 4.1 8.08V22h3.9v-2h4v2h3.9v-1.92c2.48-1.82 4.1-4.76 4.1-8.08 0-5.52-4.48-10-10-10zm-3 12c-.83 0-1.5-.67-1.5-1.5S8.17 11 9 11s1.5.67 1.5 1.5S9.83 14 9 14zm6 0c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5 1.5.67 1.5 1.5-.67 1.5-1.5 1.5z"/>
</svg>
<span>php2shell</span>
<span class="brand-tag">v1.5.1</span>
</a>
<button class="mobile-menu-btn" id="mobile-menu-btn" aria-label="Toggle Menu" aria-expanded="false">
<svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<line x1="3" y1="12" x2="21" y2="12"></line>
<line x1="3" y1="6" x2="21" y2="6"></line>
<line x1="3" y1="18" x2="21" y2="18"></line>
</svg>
</button>
<ul class="nav-links" id="nav-links">
<li><a href="#overview" class="nav-link active">Overview</a></li>
<li><a href="#vulns" class="nav-link">Vulnerabilities</a></li>
<li><a href="#features" class="nav-link">Fitur</a></li>
<li><a href="#architecture" class="nav-link">Arsitektur</a></li>
<li><a href="#install" class="nav-link">Instalasi</a></li>
<li><a href="#usage" class="nav-link">CLI Usage</a></li>
<li><a href="#scenarios" class="nav-link">Lab vs Live</a></li>
<li><a href="#security" class="nav-link">Security & Etika</a></li>
</ul>
<div class="nav-actions">
<a href="https://github.com/aarsaputra/php2shell" target="_blank" rel="noopener noreferrer" class="btn-github">
<svg width="18" height="18" viewBox="0 0 24 24" fill="currentColor">
<path d="M12 0C5.37 0 0 5.37 0 12c0 5.31 3.435 9.795 8.205 11.385.6.105.825-.255.825-.57 0-.285-.015-1.23-.015-2.235-3.015.555-3.795-.735-4.035-1.41-.135-.345-.72-1.41-1.23-1.695-.42-.225-1.02-.78-.015-.795.945-.015 1.62.87 1.845 1.23 1.08 1.815 2.805 1.305 3.495.99.105-.78.42-1.305.765-1.605-2.67-.3-5.46-1.335-5.46-5.925 0-1.305.465-2.385 1.23-3.225-.12-.3-.54-1.53.12-3.18 0 0 1.005-.315 3.3 1.23.96-.27 1.98-.405 3-.405s2.04.135 3 .405c2.295-1.56 3.3-1.23 3.3-1.23.66 1.65.24 2.88.12 3.18.765.84 1.23 1.905 1.23 3.225 0 4.605-2.805 5.625-5.475 5.925.435.375.81 1.095.81 2.22 0 1.605-.015 2.895-.015 3.3 0 .315.225.69.825.57A12.02 12.02 0 0024 12c0-6.63-5.37-12-12-12z"/>
</svg>
<span>GitHub</span>
</a>
</div>
</div>
</header>
<!-- Hero Section -->
<section class="hero-section" id="overview">
<div class="container">
<div class="hero-content">
<div class="hero-meta-badges">
<span class="badge badge-red">CVSS 4.0 · 9.2 CRITICAL</span>
<span class="badge badge-green">PHP 5.4 - 8.4.26</span>
<span class="badge badge-cyan">UNAUTHENTICATED RCE</span>
<span class="badge badge-amber">PROOF-OF-ACCESS DESIGN</span>
</div>
<h1 class="hero-title">
<span class="glitch">PHP2SHELL</span><br>
<span class="text-green glow-green">Unauthenticated RCE Chain</span>
</h1>
<p class="hero-subtitle">
Toolkit riset, reproduksi, dan verifikasi keamanan unauthenticated remote code execution
terhadap kerentanan kritis <strong>CVE-2026-109619</strong> & <strong>CVE-2026-109618</strong> pada
<code>mod_php + Apache prefork</code>. Bekerja murni lewat HTTP, tanpa dependensi fitur upload atau session target.
</p>
<div class="hero-actions">
<a href="#install" class="btn btn-primary">
<svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"></path>
<polyline points="7 10 12 15 17 10"></polyline>
<line x1="12" y1="15" x2="12" y2="3"></line>
</svg>
<span>Mulai / Install</span>
</a>
<a href="#usage" class="btn btn-secondary">
<svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<polyline points="4 17 10 11 4 5"></polyline>
<line x1="12" y1="19" x2="20" y2="19"></line>
</svg>
<span>Eksplorasi CLI Modes</span>
</a>
<a href="https://github.com/aarsaputra/php2shell" target="_blank" rel="noopener noreferrer" class="btn btn-secondary">
<span>Repo GitHub</span>
</a>
</div>
<!-- Terminal Interactive Mockup -->
<div class="terminal-window">
<div class="terminal-header">
<div class="terminal-controls">
<span class="terminal-dot dot-red"></span>
<span class="terminal-dot dot-yellow"></span>
<span class="terminal-dot dot-green"></span>
</div>
<div class="terminal-title">
<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<polyline points="4 17 10 11 4 5"></polyline>
<line x1="12" y1="19" x2="20" y2="19"></line>
</svg>
<span>bash — lota@sec-lab: ~/php2shell</span>
</div>
<div class="terminal-actions">
<button class="terminal-btn" id="btn-sim-run">Next Simulation</button>
</div>
</div>
<div class="terminal-body" id="hero-terminal-body">
<div class="terminal-prompt-line">
<span class="prompt-sym">$</span>
<span class="prompt-text" id="hero-typed-cmd"></span>
<span class="typing-cursor"></span>
</div>
<div class="terminal-output" id="hero-terminal-output"></div>
</div>
</div>
<!-- Stats Ribbon -->
<div class="stats-ribbon">
<div class="stat-item">
<div class="stat-value">5.4 - 8.4.26</div>
<div class="stat-label">Rentang PHP Rentan</div>
</div>
<div class="stat-item">
<div class="stat-value">9.2 Critical</div>
<div class="stat-label">Skor CVSS 4.0</div>
</div>
<div class="stat-item">
<div class="stat-value">46 / 46</div>
<div class="stat-label">Unit Tests Verified</div>
</div>
<div class="stat-item">
<div class="stat-value">14 Bytes</div>
<div class="stat-label">Pagar Batas Perintah</div>
</div>
<div class="stat-item">
<div class="stat-value">GPL-3.0</div>
<div class="stat-label">Lisensi Open Source</div>
</div>
</div>
</div>
</div>
</section>
<!-- Section: The Vulnerabilities -->
<section class="section" id="vulns">
<div class="container">
<div class="section-header">
<div class="section-badge"><span class="badge badge-red">THE FLAWS</span></div>
<h2 class="section-title">Anatomi Bug & Versi Terpengaruh</h2>
<p class="section-desc">
Dua kerentanan PHP kritis unauthenticated yang diumumkan Oktober 2026.
Toolkit ini mengimplementasikan rantai eksploitasi penuh untuk CVE-2026-109619.
</p>
</div>
<div class="table-scroll table-wrapper">
<table class="vuln-table">
<thead>
<tr>
<th>Parameter</th>
<th>CVE-2026-109619</th>
<th>CVE-2026-109618</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>Kelas Kerentanan</strong></td>
<td><span class="text-green">Stale Global State -> Use-After-Free (UAF)</span></td>
<td><span class="text-amber">OOM Bailout Corruption -> longjmp</span></td>
</tr>
<tr>
<td><strong>Mekanisme Trigger</strong></td>
<td>Multipart callback <code>session.upload_progress</code> dieksekusi <strong>sebelum RINIT</strong>; OOM meninggalkan <code>PS(http_session_vars)</code> / <code>PS(id)</code> dangling. Request berikutnya pada <strong>worker yang sama</strong> memicu <code>zval_ptr_dtor</code> pada memori bebas.</td>
<td><code>zend_bailout()</code> di tengah-tengah alokasi menyisakan struktur data setengah jadi di global state.</td>
</tr>
<tr>
<td><strong>Jumlah Request</strong></td>
<td><span class="badge badge-cyan">2 Request (Producer + Consumer)</span></td>
<td><span class="badge badge-amber">1 Request</span></td>
</tr>
<tr>
<td><strong>Fix-Floor Patch</strong></td>
<td><code>8.2.35 / 8.3.36 / 8.4.27 / 8.5.12</code></td>
<td><code>8.2.35 / 8.3.36 / 8.4.27 / 8.5.12</code></td>
</tr>
<tr>
<td><strong>Status di Toolkit Ini</strong></td>
<td><span class="badge badge-green">RCE (Full 0 -> RCE Chain Aktif)</span></td>
<td><span class="badge badge-amber">Deteksi & Preflight Only</span></td>
</tr>
</tbody>
</table>
</div>
<!-- Zero Requirements & Version Table Callout -->
<div class="vuln-callout">
<div class="callout-box highlight">
<h4 class="text-cyan font-mono" style="margin-bottom: 0.5rem;">Zero Target-Side Requirements</h4>
<p class="text-muted" style="margin-bottom: 0.5rem;">Rantai exploit tidak membutuhkan prasyarat aplikasi target:</p>
<ul class="feature-list">
<li>TIDAK butuh fungsi <code>session_start()</code> pada skrip target</li>
<li>TIDAK butuh fitur upload file apapun di aplikasi</li>
<li>TIDAK butuh autentikasi, cookies, atau trik header</li>
<li>Endpoint target cukup berupa satu baris: <code><?php echo "OK\n"; ?></code></li>
</ul>
</div>
<div class="callout-box">
<h4 class="text-green font-mono" style="margin-bottom: 0.5rem;">Fix-Floor & Status Branch</h4>
<p class="text-muted" style="font-size: 0.85rem; margin-bottom: 0.5rem;">
Bila versi PHP target <strong>di bawah fix-floor</strong>, sistem rentan:
</p>
<div style="font-family: var(--font-mono); font-size: 0.82rem; line-height: 1.6;">
<div>• PHP 8.4: Rentan ≤ <strong>8.4.26</strong> · Patch: <strong>8.4.27</strong></div>
<div>• PHP 8.3: Rentan ≤ <strong>8.3.35</strong> · Patch: <strong>8.3.36</strong></div>
<div>• PHP 8.2: Rentan ≤ <strong>8.2.34</strong> · Patch: <strong>8.2.35</strong></div>
<div>• PHP 8.5: Rentan ≤ <strong>8.5.11</strong> · Patch: <strong>8.5.12</strong></div>
<div>• PHP ≤ 8.1: <span class="text-red">EOL (End of Life) — Rentan permanen</span></div>
</div>
</div>
<div class="callout-box">
<h4 class="text-amber font-mono" style="margin-bottom: 0.5rem;">Catatan Advisori Resmi</h4>
<p class="text-muted" style="font-size: 0.85rem; line-height: 1.5;">
Patch PHP dibangun ulang 22 Okt 2026. <code>memory_limit=-1</code> <strong>BUKAN mitigasi lengkap</strong> (GHSA-w8hw-w9fx-j79w).
Menonaktifkan <code>session.upload_progress.enabled=0</code> hanya menutup CVE-2026-109618, <strong>tidak</strong> menutup CVE-2026-109619.
</p>
</div>
</div>
</div>
</section>
<!-- Section: Features Grid -->
<section class="section" id="features">
<div class="container">
<div class="section-header">
<div class="section-badge"><span class="badge badge-green">CAPABILITIES</span></div>
<h2 class="section-title">Fitur Utama & Karakteristik</h2>
<p class="section-desc">
Dibangun dengan filosofi riset defensif dan kendali ketat — membuktikan dampak nyata tanpa senjata perusak bebas.
</p>
</div>
<div class="features-grid">
<!-- Feature 1 -->
<div class="feature-card">
<div class="feature-icon-box">
<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"></path>
<path d="m9 12 2 2 4-4"></path>
</svg>
</div>
<h3 class="feature-title">Proof-of-Access by Design</h3>
<p class="feature-text">
Perintah eksekusi dibatasi ketat maksimal 14 byte dan difokuskan pada perintah identitas (<code>id</code>, <code>whoami</code>). Ekstraksi bukti hasil perintah terbaca otomatis via channel lab.
</p>
<ul class="feature-list">
<li>Whitelist aman: <code>id</code>, <code>whoami</code>, <code>uname</code>, <code>hostname</code></li>
<li>Permanen memblokir <code>bash</code>, <code>nc</code>, <code>curl</code>, <code>wget</code>, piping</li>
<li>Reverse shell dieliminasi total dari kode dasar</li>
</ul>
</div>
<!-- Feature 2 -->
<div class="feature-card">
<div class="feature-icon-box">
<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<rect x="2" y="3" width="20" height="14" rx="2" ry="2"></rect>
<line x1="8" y1="21" x2="16" y2="21"></line>
<line x1="12" y1="17" x2="12" y2="21"></line>
</svg>
</div>
<h3 class="feature-title">Stealth JA3 / TLS Transport</h3>
<p class="feature-text">
Mengintegrasikan <code>curl_cffi</code> untuk menirukan fingerprint TLS browser asli (Chrome, Safari, Firefox, Edge, Android) guna menghindari blokir WAF bot-mitigation biasa.
</p>
<ul class="feature-list">
<li>Impersonasi TLS/JA3 + HTTP/2 frame headers</li>
<li>Timing manusiawi dengan delay + random jitter (0.75×–1.35×)</li>
<li>Audit trail lokal: rekaman detail setiap request ke file JSONL</li>
</ul>
</div>
<!-- Feature 3 -->
<div class="feature-card">
<div class="feature-icon-box">
<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<circle cx="11" cy="11" r="8"></circle>
<line x1="21" y1="21" x2="16.65" y2="16.65"></line>
<line x1="11" y1="8" x2="11" y2="14"></line>
<line x1="8" y1="11" x2="14" y2="11"></line>
</svg>
</div>
<h3 class="feature-title">Deteksi Aktif OOM (v1.4.0+)</h3>
<p class="feature-text">
Mendeteksi target yang menyembunyikan versi di balik CDN menggunakan metodologi riset Assetnote / Searchlight Cyber dengan kunci nested-62 level (1 -> 8 -> 20 MiB).
</p>
<ul class="feature-list">
<li>Analisis fatal OOM di dalam parser multipart</li>
<li>Deteksi differential empty HTTP 500 & worker abort</li>
<li>Proteksi false-positive terhadap post_max_size guards</li>
</ul>
</div>
<!-- Feature 4 -->
<div class="feature-card">
<div class="feature-icon-box">
<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<path d="M22 12h-4l-3 9L9 3l-3 9H2"></path>
</svg>
</div>
<h3 class="feature-title">Adaptive Memory Tuning</h3>
<p class="feature-text">
Secara cerdas membaca <code>memory_limit</code> target melalui 1 request probe sebelum eksploitasi, lalu menyesuaikan ukuran field multipart stage-1 secara dinamis.
</p>
<ul class="feature-list">
<li>Otomatis set field multipart di atas limit target</li>
<li>Validasi dini prasyarat <code>post_max_size</code> ≥ 64M</li>
<li>Berhenti dalam ~2 detik jika batas memori target > 512 MB</li>
</ul>
</div>
<!-- Feature 5 -->
<div class="feature-card">
<div class="feature-icon-box">
<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<rect x="3" y="3" width="18" height="18" rx="2" ry="2"></rect>
<line x1="3" y1="9" x2="21" y2="9"></line>
<line x1="9" y1="21" x2="9" y2="9"></line>
</svg>
</div>
<h3 class="feature-title">Build Support Matrix</h3>
<p class="feature-text">
Memuat tabel 13 profil heap PHP terverifikasi (dari riset devploit & lab 9bie). Menjawab tegas apakah target berada pada tingkat RCE penuh atau sekadar leak memori.
</p>
<ul class="feature-list">
<li>Klasifikasi dukungan: RCE, LEAK, NO, atau Unknown</li>
<li>Membedakan arsitektur target: <code>amd64</code> vs <code>aarch64</code></li>
<li>Dukungan custom offset manual (<code>--zif-offset</code>)</li>
</ul>
</div>
<!-- Feature 6 -->
<div class="feature-card">
<div class="feature-icon-box">
<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<rect x="3" y="11" width="18" height="11" rx="2" ry="2"></rect>
<path d="M7 11V7a5 5 0 0 1 10 0v4"></path>
</svg>
</div>
<h3 class="feature-title">Secure Webshell Generator</h3>
<p class="feature-text">
Generator payload webshell berkeamanan tinggi dengan hash password bcrypt, batasan whitelist perintah ketat, dan masa aktif kedaluwarsa otomatis (TTL).
</p>
<ul class="feature-list">
<li>Generator standalone di subfolder <code>shell/</code> (tanpa auto-upload)</li>
<li>Hashing password dengan <code>bcrypt</code> aman</li>
<li>Kedaluwarsa otomatis (default TTL 72 jam)</li>
</ul>
</div>
</div>
</div>
</section>
<!-- Section: Architecture & How It Works -->
<section class="section" id="architecture">
<div class="container">
<div class="section-header">
<div class="section-badge"><span class="badge badge-cyan">UNDER THE HOOD</span></div>
<h2 class="section-title">Alur Kerja Eksploit & Arsitektur Modul</h2>
<p class="section-desc">
Bagaimana bug UAF dikonversi menjadi remote code execution in-process murni HTTP, serta pemetaan komponen modul toolkit.
</p>
</div>
<!-- 3-Stage Attack Flow -->
<div class="workflow-grid">
<div class="workflow-card">
<div class="workflow-step">1</div>
<h3 class="workflow-title text-green">Stage 1: Producer (OOM Trigger)</h3>
<p class="workflow-desc">
Request A mengirim payload multipart berukuran 12MB+ sebelum <code>RINIT</code>. Menyebabkan OOM pada <code>php_session_initialize()</code>, meninggalkan <code>PS(http_session_vars)</code> dangling. Worker Apache prefork mati karena <code>SIGABRT</code>.
</p>
</div>
<div class="workflow-card">
<div class="workflow-step">2</div>
<h3 class="workflow-title text-cyan">Stage 2: Consumer (ASLR Bypass)</h3>
<p class="workflow-desc">
Apache prefork melakukan fork worker baru yang mewarisi layout memori dan mapping <code>libphp</code> yang identik. Request B mengklaim ulang pointer dangling via multipart buffer dan membaca leak 4096-byte <code>Set-Cookie</code> guna mengalahkan ASLR.
</p>
</div>
<div class="workflow-card">
<div class="workflow-step">3</div>
<h3 class="workflow-title text-amber">Stage 3: Actuator (Fake HashTable)</h3>
<p class="workflow-desc">
Menyuntikkan struktur carrier fake <code>HashTable</code> dengan <code>pDestructor = zif_system</code>. Saat Apache membersihkan session di <code>zval_ptr_dtor()</code>, fungsi destruktor memanggil <code>system()</code> dengan payload perintah aman.
</p>
</div>
</div>
<!-- Module Architecture Tree -->
<div class="modules-container">
<div class="tree-box">
<h4 class="text-green font-mono" style="margin-bottom: 1rem;">Struktur Direktori Repositori</h4>
<pre style="color: #c9d1d9; font-size: 0.82rem; line-height: 1.6;">
php2shell/
├── <span class="tree-file">php2shell.py</span> <span class="tree-comment"># Single CLI entrypoint (7 subcommands)</span>
├── <span class="tree-file">install.sh</span> <span class="tree-comment"># One-shot installer (venv + deps + smoke test)</span>
├── <span class="tree-file">requirements.txt</span> <span class="tree-comment"># Minimal deps (curl_cffi, bcrypt)</span>
├── <span class="tree-file">lib/</span> <span class="tree-comment"># Core in-process engine</span>
│ ├── <span class="tree-file">chain.py</span> <span class="tree-comment"># Engine eksploit 3-stage pure Python</span>
│ ├── <span class="tree-file">transport.py</span> <span class="tree-comment"># curl_cffi JA3 impersonation & audit JSONL</span>
│ ├── <span class="tree-file">detect.py</span> <span class="tree-comment"># Fingerprint versi, SAPI, & upload_progress</span>
│ ├── <span class="tree-file">preflight.py</span> <span class="tree-comment"># Readiness score 0-90 & blocker check</span>
│ ├── <span class="tree-file">build_support.py</span> <span class="tree-comment"># 13 profil heap build (RCE vs LEAK)</span>
│ ├── <span class="tree-file">oomprobe.py</span> <span class="tree-comment"># Deteksi aktif OOM nested multipart 62-level</span>
│ ├── <span class="tree-file">memprobe.py</span> <span class="tree-comment"># Adaptive inspection memory_limit target</span>
│ ├── <span class="tree-file">exploit_runner.py</span><span class="tree-comment"># Orchestrator, pagar perintah, & auto-proof</span>
│ ├── <span class="tree-file">reporter.py</span> <span class="tree-comment"># Formatter output tabel, JSON, & CSV</span>
│ └── <span class="tree-file">banner.py</span> <span class="tree-comment"># CLI ASCII skull banner</span>
├── <span class="tree-file">shell/</span> <span class="tree-comment"># Generator webshell aman dengan bcrypt & TTL</span>
├── <span class="tree-file">lab/</span> <span class="tree-comment"># Script setup lab lokal Apache vulnerable</span>
└── <span class="tree-file">tests/</span> <span class="tree-comment"># 46+ unit tests komprehensif</span></pre>
</div>
<div class="callout-box" style="display: flex; flex-direction: column; justify-content: space-between;">
<div>
<h4 class="text-cyan font-mono" style="margin-bottom: 0.75rem;">Prinsip Desain Modular</h4>
<p class="text-muted" style="margin-bottom: 1rem; font-size: 0.9rem;">
Seluruh engine rantai eksploitasi diimplementasikan secara <strong>in-process</strong> dalam bahasa Python murni tanpa bergantung pada binary eksternal seperti <code>curl</code>, <code>gcc</code>, atau <code>readelf</code>.
</p>
<ul class="feature-list" style="font-size: 0.88rem;">
<li><strong>Zero Spawning:</strong> Tidak menjalankan child process untuk exploit HTTP</li>
<li><strong>In-Process ELF Parsing:</strong> Membaca offset symbol ELF via modul Python <code>struct</code> internal</li>
<li><strong>Offline Capable:</strong> Seluruh modul transport & payload dapat beroperasi tanpa koneksi internet ke repo eksternal</li>
<li><strong>Test-Covered:</strong> 46/46 unit tests memvalidasi pagar eksekusi, format output, dan deteksi SAPI sebelum digunakan</li>
</ul>
</div>
<div style="background: rgba(0, 255, 136, 0.05); border: 1px solid var(--accent-green-border); border-radius: var(--radius-sm); padding: 0.75rem; margin-top: 1rem;">
<span class="text-green font-mono" style="font-size: 0.82rem;">Integrity Check:</span>
<div style="font-size: 0.8rem; color: var(--text-secondary); margin-top: 0.2rem;">
Checksum SHA-256 dari <code>lib/chain.py</code> diverifikasi pada setiap peluncuran untuk memastikan integritas engine payload.
</div>
</div>
</div>
</div>
</div>
</section>
<!-- Section: Installation Guide -->
<section class="section" id="install">
<div class="container">
<div class="section-header">
<div class="section-badge"><span class="badge badge-green">GETTING STARTED</span></div>
<h2 class="section-title">Panduan Instalasi & Persiapan</h2>
<p class="section-desc">
Tiga tingkat ketergantungan. Tool inti hanya butuh Python 3.9+ dan 2 dependensi ringan.
</p>
</div>
<div class="install-grid">
<!-- Install Option 1 -->
<div class="install-card featured">
<div class="install-title text-green font-mono">
<svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<polygon points="13 2 3 14 12 14 11 22 21 10 12 10 13 2"></polygon>
</svg>
<span>01. One-Shot Installer (Disarankan)</span>
</div>
<p class="text-muted" style="font-size: 0.9rem; margin-bottom: 1rem;">
Menyiapkan virtual environment, memasang dependensi, menjalankan smoke test, dan membuat perintah global <code>php2shell</code>.
</p>
<div class="code-block-header">
<span class="code-title">Terminal Bash</span>
<button class="btn-copy">Copy</button>
</div>
<pre class="code-snippet"><code>git clone https://github.com/aarsaputra/php2shell.git
cd php2shell
bash install.sh</code></pre>
<div style="font-size: 0.82rem; color: var(--text-secondary); line-height: 1.5;">
• Opsi tanpa symlink global: <code>bash install.sh --no-bin</code><br>
• Jalankan tanpa hak akses root (non-sudo).
</div>
</div>
<!-- Install Option 2 -->
<div class="install-card">
<div class="install-title text-cyan font-mono">
<svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<path d="M16 18l6-6-6-6M8 6l-6 6 6 6"></path>
</svg>
<span>02. Manual Virtual Environment</span>
</div>
<p class="text-muted" style="font-size: 0.9rem; margin-bottom: 1rem;">
Pemasangan standar menggunakan pip untuk environment terisolasi.
</p>
<div class="code-block-header">
<span class="code-title">Terminal Bash</span>
<button class="btn-copy">Copy</button>
</div>
<pre class="code-snippet"><code>python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
python php2shell.py --help</code></pre>
<div style="font-size: 0.82rem; color: var(--text-secondary); line-height: 1.5;">
• Hanya membutuhkan <code>curl_cffi</code> (JA3) dan <code>bcrypt</code>.<br>
• Target yang mengeksekusi PHP; mesin attacker <strong>tidak wajib</strong> ada PHP.
</div>
</div>
<!-- Install Option 3 -->
<div class="install-card">
<div class="install-title text-amber font-mono">
<svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<rect x="2" y="2" width="20" height="8" rx="2" ry="2"></rect>
<rect x="2" y="14" width="20" height="8" rx="2" ry="2"></rect>
<line x1="6" y1="6" x2="6.01" y2="6"></line>
<line x1="6" y1="18" x2="6.01" y2="18"></line>
</svg>
<span>03. One-Command Docker Lab</span>
</div>
<p class="text-muted" style="font-size: 0.9rem; margin-bottom: 1rem;">
Menjalankan environment riset resmi dengan konfigurasi rentan mod_php Apache 8.4.26.
</p>
<div class="code-block-header">
<span class="code-title">Terminal Bash</span>
<button class="btn-copy">Copy</button>
</div>
<pre class="code-snippet"><code>bash lab/lab_docker.sh start
python3 docker/offsets.py
php2shell exploit -u http://127.0.0.1:8095/index.php \
--force --yes --exploit-profile bookworm -c 'id>/out/p1'</code></pre>
<div style="font-size: 0.82rem; color: var(--text-secondary); line-height: 1.5;">
• Mengunduh image resmi <code>php:8.4.26-apache</code>.<br>
• Mengonfigurasi single worker prefork & mem-mount folder <code>/out</code>.
</div>
</div>
</div>
</div>
</section>
<!-- Section: CLI Usage & Interactive Mode Showcase -->
<section class="section" id="usage">
<div class="container">
<div class="section-header">
<div class="section-badge"><span class="badge badge-cyan">COMMAND LINE INTERFACE</span></div>
<h2 class="section-title">Mode Pemakaian CLI & Contoh Perintah</h2>
<p class="section-desc">
Pilih salah satu mode kerja di bawah untuk melihat sintaks perintah, opsi flag utama, dan contoh respons terminal.
</p>
</div>
<div class="cli-tabs">
<div class="tab-nav">
<button class="tab-btn active" data-tab="tab-scan">scan</button>
<button class="tab-btn" data-tab="tab-detect">detect</button>
<button class="tab-btn" data-tab="tab-preflight">preflight</button>
<button class="tab-btn" data-tab="tab-exploit">exploit</button>
<button class="tab-btn" data-tab="tab-shell">shell</button>
<button class="tab-btn" data-tab="tab-builds">builds</button>
<button class="tab-btn" data-tab="tab-version">version</button>
</div>
<!-- Tab: scan -->
<div class="tab-content active" id="tab-scan">
<p class="cli-desc">
<strong>Mode Scan:</strong> Memindai banyak target sekaligus dari file daftar teks (<code>-l targets.txt</code>). Melakukan detect dan preflight secara paralel dengan dukungan ekspor laporan JSON dan CSV.
</p>
<div class="code-block-header">
<span class="code-title">Contoh Perintah CLI</span>
<button class="btn-copy">Copy</button>
</div>
<pre class="code-snippet"><code># Pindai banyak URL secara paralel dengan 10 threads dan simpan laporan
php2shell scan -l targets.txt --threads 10 --json out/report.json --csv out/report.csv
# Pindai dan langsung exploit target yang berstatus READY saja
php2shell scan -l targets.txt --exploit --yes --cmd id</code></pre>
<div class="table-scroll">
<table class="cli-flags-table">
<tbody>
<tr><td><code>-l, --list FILE</code></td><td>File berisi daftar URL (satu URL per baris, auto de-duplicate)</td></tr>
<tr><td><code>--threads N</code></td><td>Jumlah worker thread pemindaian concurrent (default: 5)</td></tr>
<tr><td><code>--exploit --yes</code></td><td>Lanjutkan eksekusi otomatis hanya terhadap target yang berstatus READY</td></tr>
<tr><td><code>--json / --csv PATH</code></td><td>Lokasi penyimpanan file laporan hasil scan</td></tr>
</tbody>
</table>
</div>
</div>
<!-- Tab: detect -->
<div class="tab-content" id="tab-detect">
<p class="cli-desc">
<strong>Mode Detect:</strong> Intip informasi versi PHP, status <code>upload_progress</code>, dan <code>display_errors</code> target secara read-only tanpa melakukan penyerangan exploit.
</p>
<div class="code-block-header">
<span class="code-title">Contoh Perintah CLI</span>
<button class="btn-copy">Copy</button>
</div>
<pre class="code-snippet"><code># Deteksi pasif standar via GET header
php2shell detect -u https://target.example/
# Deteksi dengan OOM aktif otomatis untuk target CDN/unknown
php2shell detect -u https://target.example/
# Matikan deteksi aktif OOM probe
php2shell detect -u https://target.example/ --no-oom</code></pre>
<div class="table-scroll">
<table class="cli-flags-table">
<tbody>
<tr><td><code>-u, --urls URL</code></td><td>Satu atau lebih URL target yang akan dideteksi</td></tr>
<tr><td><code>--no-oom</code></td><td>Matikan pengiriman probe OOM bertingkat (1/8/20 MiB)</td></tr>
<tr><td><code>--sapi {auto,fpm,mod_php}</code></td><td>Filter pembacaan sinyal crash (default: auto)</td></tr>
<tr><td><code>--check-version</code></td><td>Bandingkan versi lokal dengan repositori GitHub sebelum mendeteksi</td></tr>
</tbody>
</table>
</div>
</div>
<!-- Tab: preflight -->
<div class="tab-content" id="tab-preflight">
<p class="cli-desc">
<strong>Mode Preflight:</strong> Memberikan kalkulasi skor kesiapan exploit (0–90) dan mendeteksi kondisi blocker. Deteksi adalah informasi, bukan penghalang jalan.
</p>
<div class="code-block-header">
<span class="code-title">Contoh Perintah CLI</span>
<button class="btn-copy">Copy</button>
</div>
<pre class="code-snippet"><code># Hitung skor kesiapan target
php2shell preflight -u https://target.example/
# Tampilkan rincian koneksi HTTP secara mendetail
php2shell preflight -u https://target.example/ -v</code></pre>
<div class="table-scroll">
<table class="cli-flags-table">
<tbody>
<tr><td><code>Skor 30 Poin</code></td><td>Versi PHP terkonfirmasi di bawah fix-floor yang rentan</td></tr>
<tr><td><code>Skor 30 Poin</code></td><td>Direktif session.upload_progress.enabled terdeteksi On</td></tr>
<tr><td><code>Skor 15 Poin</code></td><td>display_errors aktif (membocorkan heap / memory error)</td></tr>
<tr><td><code>Skor 15 Poin</code></td><td>Format versi dikenali secara presisi</td></tr>
</tbody>
</table>
</div>
</div>
<!-- Tab: exploit -->
<div class="tab-content" id="tab-exploit">
<p class="cli-desc">
<strong>Mode Exploit:</strong> Mengeksekusi rantai penuh 3-stage (heap leak, ASLR defeat, fake HashTable carrier). Membutuhkan konfirmasi tegas <code>--yes</code>.
</p>
<div class="code-block-header">
<span class="code-title">Contoh Perintah CLI</span>
<button class="btn-copy">Copy</button>
</div>
<pre class="code-snippet"><code># Skenario Lab Lokal (Hasil perintah terbaca via mount /out)
php2shell exploit -u http://127.0.0.1:8095/index.php --force --yes \
--exploit-profile bookworm -c 'id>/out/p1'
# Skenario Target Live (Blind by design — verifikasi via worker restart)
php2shell exploit -u https://target.example/ --yes -c 'id'</code></pre>
<div class="table-scroll">
<table class="cli-flags-table">
<tbody>
<tr><td><code>-c, --cmd CMD</code></td><td>Perintah identitas maks 14 byte (default: id; disaring whitelist ketat)</td></tr>
<tr><td><code>--force</code></td><td>Abaikan peringatan preflight belum ready (tetap meminta konfirmasi)</td></tr>
<tr><td><code>--exploit-profile</code></td><td>Profil offset bawaan image (mis. bookworm untuk image resmi)</td></tr>
<tr><td><code>--zif-offset / --dtor-offset</code></td><td>Pasok offset alamat simbol biner libphp kustom secara manual</td></tr>
</tbody>
</table>
</div>
</div>
<!-- Tab: shell -->
<div class="tab-content" id="tab-shell">
<p class="cli-desc">
<strong>Mode Shell:</strong> Menghasilkan file webshell PHP berkeamanan tinggi dengan credential hash bcrypt, nama acak 32-hex, dan kedaluwarsa TTL. Generator murni (tidak melakukan upload).
</p>
<div class="code-block-header">
<span class="code-title">Contoh Perintah CLI</span>
<button class="btn-copy">Copy</button>
</div>
<pre class="code-snippet"><code># Generate webshell dengan masa berlaku 72 jam ke folder shell/out
php2shell shell --out shell/out --ttl 72
# Tentukan daftar perintah yang diizinkan dieksekusi di webshell
php2shell shell --out shell/out --ttl 48 --commands "id,whoami,uname,df"</code></pre>
<div class="table-scroll">
<table class="cli-flags-table">
<tbody>
<tr><td><code>--out DIR</code></td><td>Folder tujuan keluaran webshell dan file CREDENTIALS.txt</td></tr>
<tr><td><code>--ttl HOURS</code></td><td>Masa berlaku webshell dalam hitungan jam sebelum kedaluwarsa (default: 72)</td></tr>
<tr><td><code>--commands LIST</code></td><td>Daftar whitelist perintah yang diizinkan (default: id,whoami)</td></tr>
</tbody>
</table>
</div>
</div>
<!-- Tab: builds -->
<div class="tab-content" id="tab-builds">
<p class="cli-desc">
<strong>Mode Builds:</strong> Menampilkan tabel verifikasi 13 profil heap PHP. Membantu menentukan apakah target terbukti bisa di-RCE atau hanya sampai tahap memory leak.
</p>
<div class="code-block-header">
<span class="code-title">Contoh Perintah CLI</span>
<button class="btn-copy">Copy</button>
</div>
<pre class="code-snippet"><code># Tampilkan semua tabel profil build PHP
php2shell builds
# Filter hanya build yang terbukti sukses dieksekusi RCE
php2shell builds --level rce</code></pre>
<div class="table-scroll">
<table class="cli-flags-table">
<tbody>
<tr><td><code>Status RCE</code></td><td>Stage 1, 2, dan 3 terbukti sukses di arsitektur tersebut</td></tr>
<tr><td><code>Status LEAK</code></td><td>Stage 1 & 2 terbukti (leak alamat memori), stage 3 belum berhasil</td></tr>
<tr><td><code>Status NO</code></td><td>Belum pernah terbukti bisa dilanjutkan pada konfigurasi default</td></tr>
</tbody>
</table>
</div>
</div>
<!-- Tab: version -->
<div class="tab-content" id="tab-version">
<p class="cli-desc">
<strong>Mode Version:</strong> Membandingkan versi toolkit lokal dengan rilis terbaru di repositori GitHub secara fail-safe tanpa telemetri data.
</p>
<div class="code-block-header">
<span class="code-title">Contoh Perintah CLI</span>
<button class="btn-copy">Copy</button>
</div>
<pre class="code-snippet"><code># Cek versi vs rilis terbaru GitHub
php2shell version
# Abaikan cache 1 jam dan paksa fetch informasi rilis terbaru
php2shell version --no-cache</code></pre>
<div class="table-scroll">
<table class="cli-flags-table">
<tbody>
<tr><td><code>Fail-Safe</code></td><td>Tidak pernah crash atau menggagalkan pipeline bila offline atau GitHub limit</td></tr>
<tr><td><code>Tanpa Telemetri</code></td><td>Murni HTTP GET publik ke GitHub API tanpa mengirim data apapun</td></tr>
<tr><td><code>Exit Code 10</code></td><td>Mengembalikan kode keluar 10 bila terdapat update baru (cocok untuk gate CI)</td></tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
</section>
<!-- Section: Lab vs Live Target -->
<section class="section" id="scenarios">
<div class="container">
<div class="section-header">
<div class="section-badge"><span class="badge badge-amber">CRITICAL UNDERSTANDING</span></div>
<h2 class="section-title">Lab Target vs. Live Target</h2>
<p class="section-desc">
Dua skenario dengan ekspektasi hasil dan perintah yang sengaja dibedakan berdasarkan filosofi proof-of-access.
</p>
</div>
<div class="scenario-grid">
<!-- Scenario Lab -->
<div class="scenario-card lab">
<div class="scenario-header">
<h3 class="text-green font-mono">Skenario A: Lab Lokal (127.0.0.1)</h3>
<span class="badge badge-green">Full Proof</span>
</div>
<p class="text-secondary" style="font-size: 0.92rem; margin-bottom: 1rem;">
Pada lab pengujian docker lokal, folder <code>/out</code> di dalam kontainer di-mount langsung ke direktori mesin host (<code>out/p1</code>).
</p>
<pre class="code-snippet"><code>php2shell exploit -u http://127.0.0.1:8095/index.php \
--force --yes --exploit-profile bookworm -c 'id>/out/p1'
# PROOF (8.3s): uid=33(www-data) (Output terbaca otomatis)</code></pre>
<div style="font-size: 0.85rem; color: var(--text-secondary); line-height: 1.6;">
Karena folder di-mount bersama, toolkit dapat membaca file pembuktian dan menampilkan bukti user ID www-data secara langsung di layar terminal.
</div>
</div>
<!-- Scenario Live -->
<div class="scenario-card live">
<div class="scenario-header">
<h3 class="text-amber font-mono">Skenario B: Live Target (Blind by Design)</h3>
<span class="badge badge-amber">Blind by Design</span>
</div>
<p class="text-secondary" style="font-size: 0.92rem; margin-bottom: 1rem;">
Pada server live target, folder <code>/out</code> milik server tidak terhubung ke mesin penguji. Perintah dieksekusi tetapi output tidak dialirkan balik.
</p>
<pre class="code-snippet"><code>php2shell exploit -u https://target.example/ --yes -c 'id'
# Stage 1, 2, 3 selesai, tapi:
# BLIND: Perintah terkirim tanpa kanal ekstraksi data!</code></pre>
<div style="font-size: 0.85rem; color: var(--text-secondary); line-height: 1.6;">
<strong>Keputusan Desain Sadar:</strong> Membuat kanal membaca output pada target jauh sama artinya dengan membangun tool ekstraksi data (backdoor). Toolkit sengaja berhenti pada bukti eksekusi (worker crash pattern di log + stage-3 completion).
</div>
</div>
</div>
<!-- 5 Lab Requirements Box -->
<div style="margin-top: 2rem; background: var(--bg-card); border: 1px solid var(--border-card); border-radius: var(--radius-lg); padding: 1.5rem;">
<h4 class="text-green font-mono" style="margin-bottom: 0.75rem;">5 Prasyarat Kalibrasi Lab (The 5 Lab Requirements)</h4>
<div style="display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 1rem; font-size: 0.85rem;">
<div><strong class="text-cyan">1. MaxRequestWorkers 1:</strong> Memastikan producer & consumer mendarat pada worker Apache yang sama.</div>
<div><strong class="text-cyan">2. KeepAlive Off:</strong> Menghindari koneksi persisten yang mengacaukan rotasi worker.</div>
<div><strong class="text-cyan">3. Fresh offsets.env:</strong> Offset usang adalah penyebab kegagalan hening terbesar.</div>
<div><strong class="text-cyan">4. upload_progress.cleanup = On:</strong> Trigger pembersihan session struktural.</div>
<div><strong class="text-cyan">5. Minimal Endpoint:</strong> Cukup file uji sederhana <code>echo "OK";</code>.</div>
</div>
</div>
</div>
</section>
<!-- Section: Security Policy, Fence & Disclaimer -->
<section class="section" id="security">
<div class="container">
<div class="section-header">
<div class="section-badge"><span class="badge badge-red">ETHICS & GOVERNANCE</span></div>
<h2 class="section-title">Kebijakan Keamanan, Pagar & Batasan Hukum</h2>
<p class="section-desc">
Pagar perlindungan ditegakkan langsung di level kode (hard-coded fence), bukan sekadar teks peringatan dokumentasi.
</p>
</div>
<div class="security-banner">
<h3 class="text-red font-mono" style="margin-bottom: 0.75rem;">Pagar Eksekusi Ditegakkan di Level Kode</h3>
<p style="color: var(--text-primary); font-size: 0.95rem; line-height: 1.6; margin-bottom: 1.25rem;">
Toolkit ini tidak dapat dimodifikasi lewat argumen baris perintah untuk meluncurkan serangan berbahaya tak terkendali. Pembatas diverifikasi pada <code>lib/exploit_runner.py</code> sebelum paket data dikirim ke jaringan:
</p>
<div class="security-grid">
<div class="fence-card">
<h4 class="text-green font-mono">Maksimal 14 Byte</h4>
<p class="text-muted" style="font-size: 0.85rem;">Payload dibatasi hanya muat untuk perintah pembuktian identitas sederhana seperti <code>id</code> atau <code>whoami</code>.</p>
</div>