Find the PHP-to-shell exposure class — an unrestricted file upload that turns into remote code execution — written end to end in ZelC, Rocheston’s cybersecurity-native language. Read-only recon, a benign canary, an immutable verdict anchored to Rosecoin, and the fix in every report.
Read-only recon, a benign canary, risk scoring, evidence, and remediation — the entire php2shell checker, written as one ZelC playbook.
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
©️ ROCHESTON ZELC: PHP2SHELL_CHECKER.zelc
⚖️ LICENSE: PROPRIETARY / ROCHESTON ECOSYSTEM
🆔 AUTHOR: Haja Mo
🏷️ VERSION: 1.0 (Sentinel Protocol)
🎯 PURPOSE: Detect the "PHP-to-shell" exposure class — an unrestricted file
upload that leads to code execution — on a web server you are
AUTHORIZED to test. Detection only. It confirms the weakness with
a BENIGN canary (a marker file that echoes one random token and
holds no shell and no command execution), scores the risk, maps
the control, writes immutable evidence, and hands back the fix.
It never weaponizes anything.
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
package rocheston.webappsec
use net, http, crypto, aina, rosecoin, noodles, rcf
-- ════════════════════════════════════════════════════════════
-- 1. SCAN POLICY (authorized, detection-only, non-destructive)
-- ════════════════════════════════════════════════════════════
⚙️ keep SCAN_POLICY = 📦
AUTHORIZED_ONLY: true
MODE: "detect" -- never weaponize; confirm and report only
CANARY: "benign" -- marker emits one random token, nothing else
TIMEOUT_MS: 8000
VULN_RISK_FLOOR: 70 -- score at or above this reports as VULNERABLE
🛑
🔹 keep TARGET = "https://app.example.com"
note: Common places an upload handler lives. Reconnaissance is read-only.
🔹 keep UPLOAD_SURFACES = ["/upload", "/upload.php", "/api/upload", "/media/upload", "/includes/upload.php"]
note: What a hardened server should do. This ships inside every report.
🔹 keep REMEDIATION = [
"Store uploads outside the web root; serve them through a handler, never by direct URL.",
"Allow-list real content types by magic bytes — never trust the filename or its extension.",
"Disable script handlers and strip execute permission in the upload directory.",
"Rename every upload to a random token; discard the client-supplied name.",
"Put a WAF rule in front of the endpoint and log every write for evidence."
]
record Verdict
target: Text
status: Text -- VULNERABLE / HARDENED / INCONCLUSIVE
surface: Text
risk: Number
evidence_id: Text
end
-- ════════════════════════════════════════════════════════════
-- 2. BENIGN DETECTION (read-only recon + a harmless canary)
-- ════════════════════════════════════════════════════════════
⭕️ define surface_exists(base, path)
note: A plain read. Does an upload handler even answer here?
🔹 set probe = http get base + path timeout SCAN_POLICY.TIMEOUT_MS
return probe.reachable is true and probe.status < 500
🔴
⭕️ define canary_probe(base, path)
note: Ask the ZelExploits engine, in DETECT mode, to upload a benign
marker — a file that prints one random token and carries no
parameters, no shell, and no command execution — then read it
back. If the token is reflected, the server executed an uploaded
file. This is the safe, standard way to confirm the weakness.
🔹 set token = crypto random string length 16
🔹 set result = zelexploits canary_probe 📦
url: base + path
token: token
mode: "detect"
payload: "benign-marker"
🛑
return result
🔴
⭕️ define assess(base)
🔹 set finding = Verdict 📦
target: base
status: "HARDENED"
surface: "none"
risk: 0
evidence_id: "none"
🛑
⭕️ each path in UPLOAD_SURFACES
⭕️ when surface_exists(base, path) is true
🔹 set r = canary_probe(base, path)
⭕️ when r.executed is true
🔹 change finding.status = "VULNERABLE"
🔹 change finding.surface = path
return finding
🔴
⭕️ when r.accepted is true and r.stored_in_webroot is true
🔹 change finding.status = "INCONCLUSIVE"
🔹 change finding.surface = path
🔴
🔴
🔴
return finding
🔴
-- ════════════════════════════════════════════════════════════
-- 3. THE CHECKER
-- ════════════════════════════════════════════════════════════
⭕️ check PhpToShellChecker
note: ⚠️ Run only against systems you own or are authorized to test.
⭕️ when SCAN_POLICY.AUTHORIZED_ONLY is true
🔦 trace "Authorized detection run against {TARGET}"
🔴
🔹 set finding = assess(TARGET)
🧠 change finding.risk = aina risk score 📦
signal: "unrestricted_upload"
status: finding.status
surface: finding.surface
🛑
⭕️ when finding.status is "VULNERABLE"
🚨 alert critical message "🔴 PHP-to-shell exposure confirmed on {finding.surface}"
⚡ do
📝 set pack = evidence record "Upload_Exec_Confirmed" details 📦
target: finding.target
surface: finding.surface
method: "benign canary — token reflected"
risk: finding.risk
🛑
🔹 change finding.evidence_id = pack.id
🧾 rcf map control "OWASP-ASVS-12.2" to finding
🧾 rcf map control "CWE-434" to finding
📝 evidence record "Remediation" details 📦
target: finding.target
steps: REMEDIATION
🛑
⛓️ rosecoin anchor pack.id
📊 noodles build report type "vulnerability" data finding
📝 export report format "pdf" to "reports/php2shell_report.pdf"
📡 notify slack channel "#appsec" message "🔴 Upload-to-RCE confirmed on {finding.target} — report anchored."
🔴
🔴
⭕️ when finding.status is "HARDENED"
✅ alert low message "🟢 No upload-to-exec exposure found on {TARGET}"
⚡ do
📝 audit log "Scan_Clean" details "No executable upload surface on {TARGET}"
🔴
🔴
⭕️ when finding.status is "INCONCLUSIVE"
⚠️ alert medium message "🟡 Upload accepted but execution not confirmed — review {finding.surface}"
⚡ do
📝 evidence record "Needs_Review" details 📦
target: finding.target
surface: finding.surface
guidance: REMEDIATION
🛑
🔴
🔴
🔴
-- ════════════════════════════════════════════════════════════
-- 📘 OPERATOR MANUAL
-- zelc guard php2shell_checker.zelc -- taint + capability pre-flight
-- zelc run php2shell_checker.zelc -- detect against SCAN_POLICY TARGET
-- Edit TARGET to a host you are AUTHORIZED to test. Detection only — the
-- canary never executes commands, and every report ships with the fix.
-- ════════════════════════════════════════════════════════════
The whole flow stays read-only by default. The only thing that touches the target is a harmless marker — and the moment the weakness is confirmed, ZelC writes the proof and the remediation, not a foothold.
Plain reads locate the upload handler. Nothing is written, nothing is changed, until a check explicitly says so.
Confirmation uses a marker file that echoes one random token — no web shell, no parameters, no command execution. Ever.
A VULNERABLE verdict becomes an immutable evidence pack, hashed and anchored to the Rosecoin ledger for the auditor.
Every report carries the remediation and the mapped control (OWASP ASVS 12.2, CWE-434) — so the finding comes with its cure.
Point it at a target and run. This on-page demo is an illustration of the engine’s output — to scan for real, download the ZelC below and run it against systems you are authorized to test.
Idle. Enter an authorized target and press “Run ZelC check”.
⚠ Illustrative output. No request was sent to the target above. Run the downloaded ZelC for a real, authorized scan.
A quick, plain-language read on the weakness the checker hunts for — then the exact hardening for Ubuntu, Apache2, Nginx, PHP, and the PHP CLI, plus the defence-in-depth layers that cage a web shell if one ever lands.
An unrestricted file upload becomes remote code execution the moment two things are true at once: your app accepts a file it shouldn’t, and your web server is willing to run that file as a PHP script. An attacker uploads a .php file, opens its URL, and the server executes it — handing over a web shell and command execution as the www-data user.
This is CWE-434, one of the oldest and most reliable ways to own a Linux web server. It isn’t a bug in one product version — it’s the gap between a careless upload handler and a server configured to run scripts from the wrong directory.
Three classics do most of the damage. Apache with an unanchored handler will happily run shell.php.jpg because .php appears anywhere in the name. Nginx with PHP-FPM and cgi.fix_pathinfo = 1 will execute /uploads/photo.jpg as PHP when asked for /uploads/photo.jpg/x.php — the path-info trick.
And a long tail of extensions beyond .php stays executable even after you block the obvious one. Default file permissions and uploads living inside the web root finish the job.
This is a configuration and application-code class (CWE-434), not a single package bug. Any Apache2, Nginx, or PHP version is exposed if it’s misconfigured — and any version is safe once it’s hardened. So the real patch is the config below, not an apt upgrade. Keep packages current anyway, for everything else.
One concrete, version-pinned exception worth knowing: CVE-2019-11043, a genuine PHP-FPM remote-code-execution bug on Nginx. If you run Nginx + PHP-FPM, make sure PHP is at or above 7.1.33 / 7.2.24 / 7.3.11 — modern PHP 8.x is clear — and apply the Nginx try_files line below.
Treat every one of these as executable and keep them out of upload directories: .php .phar .phtml .pht .php3 .php4 .php5 .php7 .phps .inc
⚠ Paths assume PHP 8.3 on Ubuntu 24.04 (use 8.1 on 22.04). Test every change with apache2ctl configtest or nginx -t before you reload — then re-run the checker to confirm the hole is closed.
Once the checker proves the gap, the same finding drives a ZelBreach adversary-emulation drill: how far the weakness would carry an attacker, how much your blue team catches, and the evidence to prove it — all under one intent and one blast radius.
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
©️ ROCHESTON ZELBREACH: PHP2SHELL_PENTEST.🐯.zelc
⚖️ LICENSE: PROPRIETARY / AUTHORIZED COMPLIANCE TESTING
🆔 AUTHOR: Haja Mo
🏷️ VERSION: 1.0 (Tiger Protocol)
🎯 PURPOSE: A ZelBreach adversary-emulation playbook that measures how far an
unrestricted-upload weakness WOULD carry an attacker — for
authorized compliance pen-testing inside your own organization.
SIMULATION ONLY. The ZelBreach engine replays each technique in a
sandbox; nothing here touches production, and no live exploit,
payload, or web shell is carried in this file. It emulates the
chain, scores blue-team detection, and proves the gap to auditors.
(ZFS class .🐯 = adversary simulation — runs with no OS write access.)
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
package adversary.simulation
use zelbreach, aina, rosecoin, noodles, rcf, rcce
-- ════════════════════════════════════════════════════════════
-- 1. INTENT (the compiler validates every step against this)
-- ════════════════════════════════════════════════════════════
🧠 intent UploadToShellDrill 📦
category: "exploitation"
objective: "Prove unrestricted-upload-to-RCE exposure for compliance"
environment: "authorized-lab"
simulation_only: true
require_authorization: true
prohibited_actions: ["live_exploit", "data_exfiltration", "persistence", "production_write"]
🛑
-- ════════════════════════════════════════════════════════════
-- 2. BLAST RADIUS (the governor — physics enforced at compile time)
-- ════════════════════════════════════════════════════════════
⚙️ keep BLAST_LIMITS = 📦
MAX_TARGETS: 1
SCOPE: "in-scope-assets-only"
NO_LIVE_EXPLOIT: true -- technique runs in the sandbox, never on prod
TIME_WINDOW: "approved-maintenance"
🛑
note: The emulated kill chain, named at the MITRE ATTACK level only. Each
entry is a phase the engine REPLAYS in a sandbox. No operational
detail, payload, or bypass recipe lives in this playbook.
🔹 keep KILL_CHAIN = [
📦 id: "T1595" phase: "recon" label: "Enumerate upload surfaces" 🛑,
📦 id: "T1190" phase: "access" label: "Flag public-facing upload weakness" 🛑,
📦 id: "T1505.003" phase: "foothold" label: "Emulate web-shell foothold" 🛑,
📦 id: "T1083" phase: "discover" label: "Emulate discovery under containment" 🛑,
📦 id: "TA0010" phase: "evidence" label: "Capture proof and score detection" 🛑
]
🔹 keep TARGET = "lab-app-01.internal"
-- ════════════════════════════════════════════════════════════
-- 3. THE DRILL
-- ════════════════════════════════════════════════════════════
⭕️ check UploadToShellSimulation
note: ⚠️ Authorization gate — refuse to run outside simulation.
⭕️ when UploadToShellDrill.simulation_only is false
🚨 alert critical message "Refusing to run — this drill is simulation-only."
stop
🔴
🔹 set coverage = []
🔹 set halted_at = "none"
📡 notify slack channel "#purple-team" message "🐯 ZelBreach drill armed (sandbox) against {TARGET}"
⭕️ each phase in KILL_CHAIN
note: The engine replays the technique in its sandbox and reports
whether the blue-team stack would have SEEN and STOPPED it.
🧠 set step = zelbreach simulate 📦
target: TARGET
technique: phase.id
phase: phase.phase
mode: "sandbox"
blast: BLAST_LIMITS
🛑
⚡ do
📝 evidence record "Emulated_Step" details 📦
technique: phase.id
label: phase.label
detected: step.detected
blocked: step.blocked
🛑
🔹 change coverage = coverage + [step.detected]
🔴
note: Physics guard — if an emulated step would ever leave scope,
the drill halts before the next phase even begins.
⭕️ when step.in_scope is false
🚨 alert critical message "Blast-radius stop at {phase.id}"
🔹 change halted_at = phase.id
break
🔴
⭕️ when step.blocked is true
📡 notify slack channel "#purple-team" message "🛡️ Blue team stopped {phase.id} ({phase.label})"
🔹 change halted_at = phase.id
break
🔴
🔴
note: ── Score the exercise and prove it ──
🧠 set score = aina risk score 📦
signal: "upload_to_rce_drill"
coverage: coverage
halted_at: halted_at
🛑
⚡ do
🧾 rcf map control "OWASP-ASVS-12.2" to "UploadToShellDrill"
🧾 rcf gap report output "reports/upload_rce_gap.html"
🎓 rcce generate scorecard details 📦
drill: "UploadToShellDrill"
target: TARGET
detection_coverage: coverage
risk: score
🛑
📊 noodles generate evidence_pack
⛓️ rosecoin anchor evidence_pack "upload-rce-drill"
📝 audit log "Drill_Complete" details "Simulation finished — halted at {halted_at}, risk {score}"
🔴
🔴
-- ════════════════════════════════════════════════════════════
-- 📘 OPERATOR MANUAL
-- Load inside ZelBreach -> set Simulation Only -> Run.
-- zelc guard php2shell_pentest.zelc -- intent + blast-radius pre-flight
-- The .🐯 Tiger class runs in ZelBreach's sandbox with no OS write access.
-- Authorized compliance testing on in-scope assets ONLY. No live exploit,
-- payload, or web shell is contained in this playbook.
-- ════════════════════════════════════════════════════════════
The compiler validates every emulated step against a declared intent. Prohibited actions never compile.
One target, in-scope only, no live exploit. The physics engine halts the drill before it ever leaves bounds.
Each phase is named at the ATT&CK technique level and scored for blue-team detection and blocking.
Produces an RCCE scorecard and an RCF gap report — drop it straight into Level 3 lab exercises.
Six ZelBreach playbooks across the attack surface — ransomware, cloud identity, phishing, lateral movement, supply chain, API abuse. Same ZelC spine every time: intent-gated, blast-radius-capped, evidence-anchored, simulation-only. Pick one to read it.
Start with the checker and the drill below — and every playbook in the arsenal above downloads from its own panel. Pre-flight with zelc guard, then zelc run. Edit the target to a host you own or are authorized to test.
The detection-only checker. Finds the exposure, scores it, anchors the evidence, ships the fix.
The ZelBreach drill. Simulation-only adversary emulation and detection scoring for compliance pen-testing.