Sploitus

Exploit for CVE-2019-11043

kitploit · 2026-09-08

Exploit Code

MARKDOWN16 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-LINDEMER-CVE-2019-11043
# CVE-2019-11043

PHP-FPM Remote Code Execution

Screencast: https://youtu.be/d6benC5FVZM

## Overview

This zero-day exploit in common PHP-FPM configurations was discovered during the _Realworld CTF_ competition in 2019. A regular expression is used to parse the requested URI, but newline characters `%0a` are not matched. This triggers a bug in FastCGI which computes the query string length incorrectly and writes a null byte to a location _before_ the start of the intended buffer. By careful selection of the query string length, an attacker can use this bug to overwrite internal PHP variables on the server and execute arbitrary shell code.

The original Go implementation of this exploit can be found in here. I have used this, a write up and the original bug report as learning resources in order to implement the exploit in Python.

## Instructions

**Docker on Linux** Run `sudo docker run --rm -ti -p 8080:80 reproduce-cve-2019-11043` to instantiate a barebone NGINX/PHP-FPM server with an empty script at `/script.php`. The Dockerfile for this image is available , though it is not needed to run the aforementioned command.