Comment by sdfgsdfgsdsdfgs
19 hours ago
According to this https://jackalsyn.com/posts/php-up-2026.html, you need the dtor to successfully replicate the RCE on a live server.
So, theoretically, if you wanted to hack a server but you don't know what OS/PHP, version they're running, you could compile a list of every delta for every litespeed release and then bruteforce it, right?
You could. Or maybe there's a way to leak the pointers too, which would work around the need for a database.
So, source-based distros get to shine?
Not necessarily. Most apps should build in reproducible way these days. That means you can compile the same versions and likely get the same offsets. (+/- custom options applied to your local system)
Well, PHP has an insane number of compilation flags, so the chances of your build being the same as $GENERIC_PLATFORM's is not as high as you think.
So, if the offsets were in fact different, would the explots still work? (I think the answer is actually yes based on what I read/saw; I think the PoC dynamically calculates these offsets? Not 100% sure, but we shouldn't take chances.)
Correct.