Hi all! 3 days since the Internet almost melted down, I've wanted to know how you can pwn any PHP server with a single request, and the explanations have been mostly "something about out-of-memory." I found the official write-up to be quite a challenge, spending as much time on the history of PHP bugs and how this one was found as on how it works, and with key parts that are hard to follow unless you already know the conventions of the Zend engine codebase.
I'm pleased to share my first long-form animated explainer, aiming to provide a strong technical explanation of how PHP2Shell works in its first 3 minutes. Enjoy!
Comments