If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
0 Boosts
0 Likes
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
There’s absolutely shit tons of exploits for PHP2Shell on GitHub and basically none of them actually work to RCE as nobody can figure out ASLR properly.
Which is good, because patching is going to take a long time.
https://php2shell.censys.com/
If you’re wondering why your million dollar cybersecurity vendor appliances don’t have ASLR enabled.
Also update Citrix Netscaler boxes for PHP vuln, particularly if you have mgmt interface facing Internet. Why? You guessed it - ASLR is disabled.