Comment by LiveOverflow
16 hours ago
OP confirmed that the server was initially serving only an index.html. In that configuration, the vulnerable code path is never reached — it requires a .php file.
OP added php-version.php roughly 18–19 hours into the experiment (I'm not sure of the exact timing), so that period should be subtracted from the publicly displayed challenge duration.
Based on my external fingerprinting, I now believe the setup should actually be exploitable!
However, the server is being absolutely hammered with requests and crashes. Making it significantly harder to pull off. This is imo still an unrealistic target. If you are not taking the top 1% PHP websites, then they will have long periods (1 minute) of no traffic.
If someone manages to pull off a working exploit under these conditions, that would be crazy to me.
Yes! Was serving pure html through PHP before 13:00-ish UTC when I added that page. From the traffic, it seems plausible that some people have an theoretical exploit path through PHP's HTML server itself, without relying on PHP functions, but no one has pulled it off quite yet.
I’m not sure I’m understanding this comment [0] correctly, but even back then it seemed possible to get PHP involved?
[0]:<https://news.ycombinator.com/item?id=50225861>
No, PHP always just tacks that on, even when only serving static files.
what exactly is this testing or proving? do you even have session support enabled? https://news.ycombinator.com/item?id=50234093