Exploitation Summary
EIP tracks 2 public exploits for CVE-2007-1376. PoCs published by Stefan Esser.
AI-analyzed exploit summary This exploit leverages a memory disclosure vulnerability in PHP's ext/shmop and ext/gd to dump RSA private keys from memory. It scans memory for RSA key signatures and extracts them if found.
Description
The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not verify that their arguments correspond to a shmop resource, which allows context-dependent attackers to read and write arbitrary memory locations via arguments associated with an inappropriate resource, as demonstrated by a GD Image resource.
Exploits (2)
This exploit leverages a memory disclosure vulnerability in PHP's ext/shmop and ext/gd to dump RSA private keys from memory. It scans memory for RSA key signatures and extracts them if found.
This exploit leverages a memory corruption vulnerability in PHP's shmop extension to execute arbitrary shellcode. It scans Apache memory for a specific pattern, overwrites an address to redirect execution to the shellcode, and binds a shell to port 4444.