链式PHP2壳开发根 25 服务器，包括美国政府服务器
自定义 PHP2 Shell 与 Kernel LPE 连接到野生根防火墙
10月25日，"梦想"研究者发现了似乎是由中国AI辅助的运动的文物，该运动植根于25个服务器，包括位于美国政府附属环境中的系统。 攻击者将PHP2Shell与内核特权-升级利用结合起来来妥协被曝光的系统。
受影响的设备运行一个大型供应商防火墙软件的具体版本。 为了安全起见，我们不披露供应商或受影响版本，并已通知供应商。
然后攻击者发布攻击Active Directory. 所回收的文物证实了证书提取和目录清单。
业务说明，一个暴露在外的管理界面如何能够成为进入组织身份基础设施的途径。 对政府维权者来说，发现脆弱性只是开始，之后的真正挑战从查明脆弱系统到理解和遏制妥协的可能性。
以下的研究是用Dream的自发网络研究产品"英雄"进行主动的威胁猎取。
发现
梦想研究者确定了一个完整的攻击操作，其中包括PHP2Shell开发链的自定义武器化(CVE-2026-109618/CVE-2026-109619)与Fragnesia内核特权升级(CVE-2026-4300)，目标列表，开发日志，以及约40个自定义的开发后脚本。
其中包括在美国、日本、台湾和韩国各地植根了25个服务器的运动文物。 攻击者一旦扎根就会在美国政府附属的环境下在三个特定的服务器上出现零落
发现的文物揭示了一种从实验室环境中开发开发开始，最后持续进入美国政府组织内部Active Directory域的操作。
AI 攻击中的使用
我们还看到一些AI协助攻击基础设施的工具：
- Claude Code已安装
- 一个称为aiscan的AI动力攻击性安全平台配置了中国LLMs和Kimi
- 中国侦察平台FOFA的API密钥在场
虽然我们没有直接证据表明AI工具是专门用来写开发或开发后脚本的，但是代码结构，评论风格，以及跨~40个脚本的一致性都暗示了AI协助开发。 称，这次行动似乎不是完全自治的民族国家攻击。
剥削：两个脆弱环节连入一个请求
攻击者开发出两个独立的开发，将它们连在一起，以便在没有任何资格的单一HTTP请求中，在运行一个大型供应商防火墙软件的特定版本的任何防火墙上实现根接入。
PHP2壳(CVE-2026-109618 / CVE-2026-109619)-远程代码执行。
我们恢复的实施是一种习俗，非公共建筑，而不是PHP2Shell的任何已知公共开发的复制品。 它遵循了同样的基本概念，但似乎是为目标防火墙平台而独立制定和定制的。
弱点针对PHP会话.upload 进步机制在防火墙的appweb管理服务器上。 防火墙OS使用PHP 8.0.30，内存限制高，使得攻击的内存腐败阶段成为可能。
攻击分四个阶段进行：
- A1——记忆耗尽(~383MB)：攻击者用多部分 POST 请求将服务器淹没，每个请求都包含大量的文件名和会话进度数据。 这把PHP的内存分配器推向了它的极限，迫使系统进入了可预测的内存布局。
- B1 — Information leak：第二项请求从A1中伪造了 stale session ID长度，强制读取出界。 服务器的Set-Cookie响应头带有被泄露的指针值——让攻击者得到libphp的基址。 因此，在运行过程中。
- A2 — Stale 参考设置(~500MB)：另一回内存压力初始化了会话，留下了http session vars作为活的zend 引用，然后触发了第二个OOM留下mod data=NULL——在B2中创建了攻击者可以伪造的 stale 引用。
- B2 — 代码执行：最终请求在释放的内存区域中伪造了 PHP Hashtable 条目。 被伪造的条目的pDistructor召回指向zif system(PHP's system ())函数，其数据指向 shell 命令字符串。 当PHP的清理处理器行走"HashTable"时，它称为被伪造的破坏器——作为无名用户执行任意命令。
断裂症(CVE-2026-4600)-克内尔枢密院院系升级
由于 SELinux 限制 httpd t 修改系统文件，以无人身份执行代码是不够的。 为了完成"根"，攻击者在第二个开发中链入：XFRM ESP-in-TCP子系统中的Linux内核脆弱性。
Fragnesia 使用 page-cache 写作来覆盖 /etc/pam.d/su ——用 pam permit.so(接受全部)来取代其认证规则。 由于PAM文件只有774个字节，因此开发使用每字节分型的变体来精确地写出。 覆盖后，su root 在没有密码的情况下成功。
这两种开发都运行在单一的B2 HTTP请求中。 总链——从未经认证的HTTPS连接到持久的根网壳——在不到15分钟后完成。
实验室：按规模分析版本
开发并不是一个单一的起火和被遗忘的有效载荷。 它要求精确的内存抵消防火墙OS版本的不同——zval ptr dtor的地址，zif system的地址，Hashtable结构大小，以及控制每个阶段的堆积布局的内存几何参数。
在回收的文物中，我们发现了11个JSON版本简介文件——每个防火墙OS版本都有一个文件，已经测试过：
每个剖面图包含从 liphp 中提取的精确偏移。 这个版本的二进制——每个库的SHA256散列，ELF建立ID，以及精确的内存几何参数(cunk大小，填充计数，排水计数，喷雾抵消)通过实验室测试来调取。
"校正"和"临时"剖面的区别是显著的——校正指攻击者对该版本的运行中的VM测试了开发，并确认了内存几何作品。 暂时意味着他们从二进制中计算抵消但没有在现场验证
运动漏斗：从19 000起被发现到25起被剥削
攻击者发布是继一个清晰的漏斗之后
第一阶段：全球发现(19 000个目标)
攻击者使用类似于Shodan的中国互联网资产搜索引擎FOFA，这些设备具有管理界面，可以接触到互联网，通过证书指纹和HTTP响应签名来发现。
第2阶段：版本指纹(5 000活体)
一个自定义的版本扫描仪对所有19 000个目标运行了200个并发线程，确定了哪些设备实际在线运行，以及运行的OS版本。 约有5 000人提供了版本信息。
第3阶段：地理和版本过滤(240个目标)
从5000个活装置，攻击者过滤到仅位于美国，日本，台湾和韩国的服务器。 他们随后进一步过滤到符合其开发配置的版本(较新的发布分支运行于PHP 8.0.30. 这产生了240个防火墙的最终目标清单。
由于美国、日本、台湾和韩国是中国在太平洋剧场开展国家结盟网络行动的四大战略对手和情报目标，这表明潜在的民族国家对手努力。
阶段4：自动利用(24个根基)
240个目标被装入一个自动分批跑跑者中，一次对5个目标进行利用，每个目标1800秒(30分钟)的超时。 每次成功，批次：
- 运行完整的PHP2壳 + Fragnesia 链
- 在防火墙上的可公开访问的目录中规划了一个103字节的 PHP root webshell
- 通过webshell执行 id 验证了根
- 登录目标主机名和IP成功 CSV
- 移动到下一个目标
此时，24个防火墙已经成功扎根。
第5阶段：调整(确定2个防火墙的优先次序)
对于24个植入地防火墙中的22个，攻击者除了植入网壳外，没有做任何事情。 没有持久性，没有隧道，没有开发后的工具。 服务器被有效拥有并被停放，使攻击者可以随时通过webshell返回。
两个服务器似乎与一个目标相关联，现已超越这一阶段。 两者似乎都属于美国政府附属的环境。
第6阶段：关键环节(从防火墙到域)
在24个植根防火墙中，有两个属于美国政府下属组织。 从第一个防火墙中提取的运行配置揭示了一种具有暗示政府从属关系的特征的环境：CAC(Common Access Card)认证，一个特定的命名前缀，以及标准化的政府式资产命名。 配置文件包含组织完整的内部网络地形：域名控制器，一个中央防火墙管理服务器，一个Keycloak SSO服务器，GitLab实例，VPN网关，以及活性目录域。
首个防火墙于协调世界时10月23日18:14分在自动化批发期间被根植。 但不久后——可能从剥削交通的~900MB——坠毁，再也没有上线。 攻击者用240个自动探测器在2个多小时的时间里监视了它，等待它恢复。 它没有。 第二道防火墙的证书数据将其与目标组织明确联系起来，在最初的批次中已经超时。
认识到组织从第一个防火墙的配置中的价值，攻击者在协调世界时10:09(UTC)10月24日创建了单独的，专注的运动并成功利用了它。
数小时内，攻击者：
建成贯通内地道。
一条由8个端口倒转的SSH隧道将被破坏的防火墙连接回运营商的基础设施，转发访问权限到：
- 域控制器(LDAP、LDAPS、RDP)
- 内部防火墙管理服务器
- VPN基础设施
- SOCKS5 任意内部网络访问的代理
地道被包裹在一个系统的服务和rc. local shoot h钩上——它能活下来再生并自动重接。
利用管理服务器通过地道。 在协调世界时11:35，在根起第二道防火墙后不到90分钟，攻击者就使用新获得的服务器访问权限和同为PHP2Shell + Fragnesia 链来对抗第三道政府服务器——内部防火墙管理服务器，该服务器只能通过地道到达。 这个服务器集中管理组织的所有防火墙。 妥协让攻击者可以访问每个管理下的防火墙配置，证书，以及网络设置。 这使被利用的服务器总数达到25个。
发布来自管理服务器的AD攻击活动。 由于管理服务器已经拥有LDAP与Active Directory的连接(它需要它来认证VPN用户)，攻击者将它作为他们的发布平台进行域攻击：
-解密了LDAP服务账户密码——设备配置存储它加密，但有了根接通，攻击者有主密钥。 他们用简洁的文字把它取出，并用硬码把它写入后来的每个剧本。
- 通过LDAP查询对域中的每个用户和组进行假设。
- 使用组织主题密码，向每个用户账户喷出密码。 域名有锁出Streshold=0——指没有帐户锁出，允许无限喷出尝试。
- 试图创建后门AD账户——两者都是用户账户(在前夕试用)
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Chained PHP2Shell Exploit Roots 25 Servers, including US Government Servers
Custom PHP2Shell Exploit Chained with Kernel LPE to Root Firewalls in the Wild
On October 25, Dream researchers uncovered artifacts of what appeared to be a Chinese AI-assisted campaign that rooted 25 servers, including systems in a US government-affiliated environment. The attacker combined PHP2Shell with a kernel privilege-escalation exploit to compromise exposed systems.
The affected devices run specific versions of a large vendor’s firewall software. For security purposes, we are not disclosing the vendor or the affected versions, and the vendor has been notified.
The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration.
The operation illustrates how an exposed management interface can become a path into an organization’s identity infrastructure. For government defenders, vulnerability discovery is just the beginning, after which the real challenge extends from identifying vulnerable systems to understanding and containing the access a compromise makes possible.
The research below was conducted with proactive threat hunting using Dream’s autonomous cyber research product, Hero.
Discovery
Dream researchers identified a complete attack operation that included a custom weaponization of the PHP2Shell exploit chain (CVE-2026-109618/CVE-2026-109619) paired with the Fragnesia kernel privilege escalation (CVE-2026-46300), target lists, exploitation logs, and approximately 40 custom post-exploitation scripts.
This included artifacts of a campaign that had rooted 25 servers across the United States, Japan, Taiwan, and South Korea. Once rooted, the attacker zeroed in on three specific servers in a US government-affiliated environment.
The discovered artifacts revealed an operation that began with exploit development in a lab environment and ended with persistent access to a US government organization's internal Active Directory domain.
AI Usage in Attack
We also observed some evidence of AI-assisted tooling in the attack infrastructure:
- Claude Code had been installed
- An AI-powered offensive security platform called aiscan was configured with Chinese LLMs DeepSeek and Kimi
- API keys for the Chinese reconnaissance platform FOFA were present
While we have no direct evidence that the AI tools were specifically used to write the exploit or the post-exploitation scripts, the code structure, commenting style, and consistency across ~40 scripts suggest AI-assisted development. That said, this operation does not appear to be a fully autonomous nation-state attack.
The Exploit: Two Vulnerabilities Chained Into One Request
The attacker developed two separate exploits and chained them together to achieve root access on any firewall running specific versions of a large vendor’s firewall software in a single HTTP request without any credentials.
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — Remote Code Execution
The implementation we recovered is a custom, non-public build, not a copy of any known public exploit for PHP2Shell. It follows the same underlying concept but appears to have been independently developed and tailored specifically for the targeted firewall platform.
The vulnerability targets PHP's session.upload_progress mechanism on the firewall's appweb management server. The firewall OS uses PHP 8.0.30 with a high memory limit that enables the memory corruption stages of the attack.
The attack works in four orchestrated stages:
- A1 — Memory Exhaustion (~383MB): The attacker floods the server with crafted multipart POST requests, each containing massive filenames and session progress data. This pushes PHP's memory allocator to its limits, forcing the system into a predictable memory layout.
- B1 — Information Leak: A second request forges the stale session ID length from A1, forcing an out-of-bounds read. The server's Set-Cookie response header carries the leaked pointer value — giving the attacker the base address of libphp.so in the running process.
- A2 — Stale Reference Setup (~500MB): Another round of memory pressure initializes a session, leaving http_session_vars as a live zend_reference, then triggers a second OOM that leaves mod_data=NULL — creating a stale reference the attacker can forge in B2.
- B2 — Code Execution: The final request forges a PHP HashTable entry in the freed memory region. The forged entry's pDestructor callback points to zif_system (PHP's system() function), and its data points to a shell command string. When PHP's cleanup handler walks the HashTable, it calls the forged destructor — executing arbitrary commands as the nobody user.
Fragnesia (CVE-2026-46300) — Kernel Privilege Escalation
Getting code execution as nobody isn't enough since SELinux confines httpd_t from modifying system files. In order to complete the root, the attacker chained in a second exploit: a Linux kernel vulnerability in the XFRM ESP-in-TCP subsystem.
Fragnesia uses page-cache writes to overwrite /etc/pam.d/su — replacing its authentication rules with pam_permit.so (accept all). Because the PAM file is only 774 bytes, the exploit uses a per-byte splicing variant to write it precisely. After the overwrite, su root succeeds without a password.
Both exploits run in a single B2 HTTP request. The total chain — from unauthenticated HTTPS connection to persistent root webshell — completes in under 15 minutes.
The Lab: Version Profiling at Scale
The exploit is not a single fire-and-forget payload. It requires precise memory offsets that differ between firewall OS versions — the address of zval_ptr_dtor, the address of zif_system, HashTable structure sizes, and memory geometry parameters that control the heap layout during each stage.
Among the recovered artifacts, we found 11 JSON version profile files — one for each firewall OS version that had been tested:
Each profile contains the exact offsets extracted from the libphp.so binary of that version — with SHA256 hashes of each library, ELF build IDs, and precise memory geometry parameters (chunk sizes, fill counts, drain counts, spray offsets) tuned through lab testing.
The difference between "calibrated" and "provisional" profiles is notable — calibrated means the attacker tested the exploit against a running VM of that version and confirmed the memory geometry works. Provisional means they calculated offsets from the binary but haven't verified on a live instance.
The Campaign Funnel: From 19,000 Discovered to 25 Exploited
With the exploit ready and profiles for 9 exploitable versions, the attacker launched a targeting campaign that followed a clear funnel:
Stage 1: Global Discovery (19,000 targets)
Using FOFA — a Chinese internet asset search engine similar to Shodan — the attacker identified approximately 19,000 internet-facing firewalls from the targeted vendor worldwide. These were devices with management interfaces exposed to the internet, discoverable through certificate fingerprints and HTTP response signatures.
Stage 2: Version Fingerprinting (5,000 alive)
A custom version scanner ran with 200 concurrent threads against all 19,000 targets, identifying which devices were actually online and what OS version they were running. Approximately 5,000 responded with version information.
Stage 3: Geographic and Version Filtering (240 targets)
From the 5,000 alive devices, the attacker filtered to servers located in only United States, Japan, Taiwan, and South Korea. They then further filtered to versions matching their exploit profiles (the newer release branches running PHP 8.0.30). This produced a final target list of 240 firewalls.
Since US, Japan, Taiwan, and South Korea are the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater, this indicates potential nation-state adversary efforts.
Stage 4: Automated Exploitation (24 rooted)
The 240 targets were fed into an automated batch runner that exploited them five at a time, with an 1800-second (30-minute) timeout per target. For each success, the batch:
- Ran the full PHP2Shell + Fragnesia chain
- Planted a 103-byte PHP root webshell in a publicly accessible directory on the firewall
- Verified root by executing id through the webshell
- Logged the target's hostname and IP to a success CSV
- Moved to the next target
At this point, 24 firewalls had been successfully rooted.
Stage 5: Triage (2 firewalls prioritized)
For 22 of the 24 rooted firewalls, the attacker did nothing beyond planting the webshell. No persistence, no tunnels, no post-exploitation tools. The servers were effectively owned and parked, allowing the attacker to return through the webshell at any time.
Two servers seemingly associated with one target progressed beyond this stage. Both appeared to belong to a US government-affiliated environment.
Stage 6: The Pivot (Shifting from Firewall to Domain)
Among the 24 rooted firewalls, two belonged to a US government-affiliated organization. The running configuration extracted from the first firewall revealed an environment with characteristics suggesting government affiliation: CAC (Common Access Card) authentication, a specific naming prefix, and standardized government-style asset naming. The configuration file contained the organization's complete internal network topology: domain controllers, a central firewall management server, a Keycloak SSO server, a GitLab instance, VPN gateways, and the Active Directory domain.
The first firewall was rooted on Oct 23 at 18:14 UTC during the automated batch. But it crashed shortly after — likely from the ~900MB of exploit traffic — and never came back online. The attacker monitored it with 240 automated probes over two hours, waiting for it to recover. It didn't. The second firewall, whose certificate data definitively linked it to the target organization, had timed out during the original batch.
Recognizing the organization's value from the first firewall's configuration, the attacker created a separate, dedicated campaign and successfully exploited it on Oct 24 at 10:09 UTC.
Within hours, the attacker:
Built a persistent tunnel into the internal network.
An 8-port reverse SSH tunnel connected the compromised firewall back to the operator's infrastructure, forwarding access to:
- Domain controllers (LDAP, LDAPS, RDP)
- The internal firewall management server
- VPN infrastructure
- A SOCKS5 proxy for arbitrary internal network access
The tunnel was wrapped in a systemd service and an rc.local boot hook — it survives reboots and automatically reconnects.
Exploited the management server through the tunnel. At 11:35 UTC, less than 90 minutes after rooting the second firewall, the attacker used the newly gained server access and the same PHP2Shell + Fragnesia chain against a third government server - the internal firewall management server that was only reachable through the tunnel. This server centrally manages all of the organization's firewalls. Compromising it gave the attacker access to every managed firewall's configuration, credentials, and network settings. This brought the total number of servers exploited to 25.
Launched an AD attack campaign from the management server. Because the management server already had LDAP connectivity to Active Directory (it needs it to authenticate VPN users), the attacker used it as their launch platform for domain attacks:
- Decrypted the LDAP service account password — the device config stores it encrypted, but with root access the attacker has the master key. They extracted it in plaintext and hardcoded it into every subsequent script.
- Enumerated every user and group in the domain via LDAP queries.
- Sprayed passwords against every user account using organization-themed passwords. The domain had lockoutThreshold=0 — meaning no account lockout, allowing unlimited spray attempts.
- Attempted to create backdoor AD accounts — both a user account (tried in eve
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.