First of all, thanks to KillaBoi for his great work!

For days I was reading many threads saying that PHP2Shell is very hard to exploit, with no working public PoC available. Honestly, I patched my servers but had no way to verify if the patches actually worked. And ecently, reading the PoC from KillaBoi gave me the idea to make it easier to verify my servers, so I wanted to share it here with you: https://github.com/MartinPham/php2shell-poc

The exploit requires some specific information to work, like the PHP version, the binary's properties (how it was built, optimizations, etc.) and the runtime configuration. Yes, you can hide these from others, but anyone who knows the Docker image or PHP build can calculate the exact values needed to exploit your servers.

The repository contains:

- The Lab (compose.yml + lab/): a PHP/nginx setup to test against (nginx and PHP versions are not exposed to the client)

- poc.py: a single self-contained script that both calculates the needed values from a Docker image and runs the exploit against the target

I decided to make this public because others will find a way to exploit it anyway, so please patch your servers now.