Skip to content

Instantly share code, notes, and snippets.

@WangYihang

WangYihang/php-system-id-bruter.py

Created October 6, 2021 11:04
Show Gist options
  • Save WangYihang/a8bcac3dd3b89dcbafe3a40be9b82c3e to your computer and use it in GitHub Desktop.
Save WangYihang/a8bcac3dd3b89dcbafe3a40be9b82c3e to your computer and use it in GitHub Desktop.
Download ZIP
Raw
php-system-id-bruter.py
from sys import version
import semver
import requests
import itertools
from bs4 import BeautifulSoup
def md5(data):
if type(data) is str:
data = bytes(data, encoding='utf-8')
return __import__('hashlib').md5(data).hexdigest()
'''
// Part 1
#define PHP_VERSION "7.0.0"
// Part 2
#define ZEND_EXTENSION_BUILD_ID "API" ZEND_TOSTR(ZEND_EXTENSION_API_NO) ZEND_BUILD_TS ZEND_BUILD_DEBUG ZEND_BUILD_SYSTEM ZEND_BUILD_EXTRA
#define ZEND_EXTENSION_API_NO 320151012
#ifdef ZTS
#define ZEND_BUILD_TS ",TS"
#else
#define ZEND_BUILD_TS ",NTS"
#endif
#if ZEND_DEBUG
#define ZEND_BUILD_DEBUG ",debug"
#else
#define ZEND_BUILD_DEBUG
#endif
#if defined(ZEND_WIN32) && defined(PHP_COMPILER_ID)
#define ZEND_BUILD_SYSTEM "," PHP_COMPILER_ID
#else
#define ZEND_BUILD_SYSTEM
#endif
#define ZEND_BUILD_EXTRA
// Part 3
// php-7.0.0
#define ZEND_BIN_ID "BIN_" ZEND_TOSTR(SIZEOF_CHAR) ZEND_TOSTR(SIZEOF_INT) ZEND_TOSTR(SIZEOF_LONG) ZEND_TOSTR(SIZEOF_SIZE_T) ZEND_TOSTR(SIZEOF_ZEND_LONG) ZEND_TOSTR(ZEND_MM_ALIGNMENT)
// php-7.4.0
#define ZEND_BIN_ID "BIN_" ZEND_TOSTR(SIZEOF_INT) ZEND_TOSTR(SIZEOF_LONG) ZEND_TOSTR(SIZEOF_SIZE_T) ZEND_TOSTR(SIZEOF_ZEND_LONG) ZEND_TOSTR(ZEND_MM_ALIGNMENT)
#define SIZEOF_CHAR 1
#define SIZEOF_INT 4
#define SIZEOF_LONG 4
#define SIZEOF_SIZE_T 4
#define SIZEOF_ZEND_LONG 4
#define ZEND_MM_ALIGNMENT Z_L(4)
'''
# Part 1
# All php versions from git repo
PHP_VERSION = ["7.0.0", "7.0.0RC1", "7.0.0RC2", "7.0.0RC3", "7.0.0RC4", "7.0.0RC5", "7.0.0RC6", "7.0.0RC7", "7.0.0RC8", "7.0.0alpha1", "7.0.0alpha2", "7.0.0beta1", "7.0.0beta2", "7.0.0beta3", "7.0.1", "7.0.1RC1", "7.0.2", "7.0.2RC1", "7.0.3", "7.0.3RC1","7.0.4", "7.0.4RC1", "7.0.5", "7.0.5RC1", "7.0.6", "7.0.6RC1", "7.0.7", "7.0.7RC1", "7.0.8", "7.0.8RC1", "7.0.9", "7.0.9RC1", "7.0.10", "7.0.10RC1", "7.0.11", "7.0.11RC1", "7.0.12", "7.0.12RC1", "7.0.13", "7.0.13RC1", "7.0.14", "7.0.14RC1", "7.0.15", "7.0.15RC1", "7.0.16", "7.0.16RC1", "7.0.17", "7.0.17RC1", "7.0.18", "7.0.18RC1", "7.0.19", "7.0.19RC1", "7.0.20", "7.0.20RC1", "7.0.21", "7.0.21RC1", "7.0.22", "7.0.22RC1", "7.0.23", "7.0.23RC1", "7.0.24", "7.0.24RC1", "7.0.25", "7.0.25RC1", "7.0.26", "7.0.26RC1", "7.0.27", "7.0.27RC1", "7.0.28", "7.0.29", "7.0.30", "7.0.31", "7.0.32", "7.0.33", "7.1.0", "7.1.0RC1", "7.1.0RC2", "7.1.0RC3", "7.1.0RC4", "7.1.0RC5", "7.1.0RC6", "7.1.0alpha1", "7.1.0alpha2", "7.1.0alpha3", "7.1.0beta1", "7.1.0beta2", "7.1.0beta3", "7.1.1", "7.1.1RC1", "7.1.2", "7.1.2RC1", "7.1.3", "7.1.3RC1", "7.1.4", "7.1.4RC1", "7.1.5", "7.1.5RC1", "7.1.6", "7.1.6RC1", "7.1.7", "7.1.7RC1", "7.1.8", "7.1.8RC1", "7.1.9", "7.1.9RC1", "7.1.10", "7.1.10RC1", "7.1.11", "7.1.11RC1", "7.1.12", "7.1.12RC1", "7.1.13", "7.1.13RC1", "7.1.14", "7.1.14RC1", "7.1.15", "7.1.15RC1", "7.1.16", "7.1.16RC1", "7.1.17", "7.1.17RC1", "7.1.18", "7.1.18RC1", "7.1.19", "7.1.19RC1", "7.1.20", "7.1.20RC1", "7.1.21", "7.1.21RC1", "7.1.22", "7.1.22RC1", "7.1.23", "7.1.23RC1", "7.1.24", "7.1.24RC1", "7.1.25", "7.1.25RC1", "7.1.26", "7.1.27", "7.1.28", "7.1.29", "7.1.30", "7.1.31", "7.1.32", "7.1.33", "7.2.0", "7.2.0RC1", "7.2.0RC2", "7.2.0RC3", "7.2.0RC4", "7.2.0RC5", "7.2.0RC6", "7.2.0alpha1", "7.2.0alpha2", "7.2.0alpha3", "7.2.0beta1", "7.2.0beta2", "7.2.0beta3", "7.2.1", "7.2.1RC1", "7.2.2", "7.2.2RC1", "7.2.3", "7.2.3RC1", "7.2.4", "7.2.4RC1", "7.2.5", "7.2.5RC1", "7.2.6", "7.2.6RC1", "7.2.7", "7.2.7RC1", "7.2.8", "7.2.8RC1", "7.2.9", "7.2.9RC1", "7.2.10", "7.2.10RC1", "7.2.11", "7.2.11RC1", "7.2.12", "7.2.12RC1", "7.2.13", "7.2.13RC1", "7.2.14", "7.2.14RC1", "7.2.15", "7.2.15RC1", "7.2.16", "7.2.16RC1", "7.2.17", "7.2.17RC1", "7.2.18", "7.2.18RC1", "7.2.19", "7.2.19RC1", "7.2.20", "7.2.20RC1", "7.2.20RC2", "7.2.21", "7.2.21RC1", "7.2.22", "7.2.22RC1", "7.2.23", "7.2.23RC1", "7.2.24", "7.2.24RC1", "7.2.25", "7.2.25RC1", "7.2.26", "7.2.26RC1", "7.2.27", "7.2.28", "7.2.29", "7.2.30", "7.2.31", "7.2.32", "7.2.33", "7.2.34", "7.3.0", "7.3.0RC1", "7.3.0RC2", "7.3.0RC3", "7.3.0RC4", "7.3.0RC5", "7.3.0RC6", "7.3.0alpha1", "7.3.0alpha2", "7.3.0alpha3", "7.3.0alpha4", "7.3.0beta1", "7.3.0beta2", "7.3.0beta3", "7.3.1", "7.3.1RC1", "7.3.2", "7.3.2RC1", "7.3.3", "7.3.3RC1", "7.3.4", "7.3.4RC1", "7.3.5", "7.3.5RC1", "7.3.6", "7.3.6RC1", "7.3.7", "7.3.7RC1", "7.3.7RC2", "7.3.7RC3", "7.3.8", "7.3.8RC1", "7.3.9", "7.3.9RC1", "7.3.10", "7.3.10RC1", "7.3.11", "7.3.11RC1", "7.3.12", "7.3.12RC1", "7.3.13", "7.3.13RC1", "7.3.14", "7.3.14RC1", "7.3.15", "7.3.15RC1", "7.3.16", "7.3.16RC1", "7.3.17", "7.3.17RC1", "7.3.18", "7.3.18RC1", "7.3.19", "7.3.19RC1", "7.3.20", "7.3.20RC1", "7.3.21", "7.3.21RC1", "7.3.22", "7.3.22RC1", "7.3.23", "7.3.23RC1", "7.3.24", "7.3.24RC1", "7.3.25", "7.3.25RC1", "7.3.26", "7.3.26RC1", "7.3.27", "7.3.28", "7.3.29", "7.3.30", "7.3.31", "7.4.0", "7.4.0RC1", "7.4.0RC2", "7.4.0RC3", "7.4.0RC4", "7.4.0RC5", "7.4.0RC6", "7.4.0alpha1", "7.4.0alpha2", "7.4.0alpha3", "7.4.0beta1", "7.4.0beta2", "7.4.0beta4", "7.4.1", "7.4.1RC1", "7.4.2", "7.4.2RC1", "7.4.3", "7.4.3RC1", "7.4.4", "7.4.4RC1", "7.4.5", "7.4.5RC1", "7.4.6", "7.4.6RC1", "7.4.7", "7.4.7RC1", "7.4.8", "7.4.8RC1", "7.4.9", "7.4.9RC1""7.4.10", "7.4.10RC1", "7.4.11", "7.4.11RC1", "7.4.12", "7.4.12RC1", "7.4.13", "7.4.13RC1", "7.4.14", "7.4.14RC1", "7.4.15", "7.4.15RC1", "7.4.15RC2", "7.4.16", "7.4.16RC1", "7.4.17RC1", "7.4.18", "7.4.18RC1", "7.4.19", "7.4.20", "7.4.20RC1", "7.4.21", "7.4.21RC1", "7.4.22", "7.4.22RC1", "7.4.23", "7.4.23RC1", "7.4.24", "7.4.24RC1", "7.4.25RC1"]
# All php versions without release candidates
# PHP_VERSION = ["7.0.0", "7.0.1", "7.0.2", "7.0.3", "7.0.4", "7.0.5", "7.0.6", "7.0.7", "7.0.8", "7.0.9", "7.0.10", "7.0.11", "7.0.12", "7.0.13", "7.0.14", "7.0.15", "7.0.16", "7.0.17", "7.0.18", "7.0.19", "7.0.20", "7.0.21", "7.0.22", "7.0.23", "7.0.24", "7.0.25", "7.0.26", "7.0.27", "7.0.28", "7.0.29", "7.0.30", "7.0.31", "7.0.32", "7.0.33", "7.1.0", "7.1.1", "7.1.2", "7.1.3", "7.1.4", "7.1.5", "7.1.6", "7.1.7", "7.1.8", "7.1.9", "7.1.10", "7.1.11", "7.1.12", "7.1.13", "7.1.14", "7.1.15", "7.1.16", "7.1.17", "7.1.18", "7.1.19", "7.1.20", "7.1.21", "7.1.22", "7.1.23", "7.1.24", "7.1.25", "7.1.26", "7.1.27", "7.1.28", "7.1.29", "7.1.30", "7.1.31", "7.1.32", "7.1.33", "7.2.0", "7.2.1", "7.2.2", "7.2.3", "7.2.4", "7.2.5", "7.2.6", "7.2.7", "7.2.8", "7.2.9", "7.2.10", "7.2.11", "7.2.12", "7.2.13", "7.2.14", "7.2.15", "7.2.16", "7.2.17", "7.2.18", "7.2.19", "7.2.20", "7.2.21", "7.2.22", "7.2.23", "7.2.24", "7.2.25", "7.2.26", "7.2.27", "7.2.28", "7.2.29", "7.2.30", "7.2.31", "7.2.32", "7.2.33", "7.2.34", "7.3.0", "7.3.1", "7.3.2", "7.3.3", "7.3.4", "7.3.5", "7.3.6", "7.3.7", "7.3.8", "7.3.9", "7.3.10", "7.3.11", "7.3.12", "7.3.13", "7.3.14", "7.3.15", "7.3.16", "7.3.17", "7.3.18", "7.3.19", "7.3.20", "7.3.21", "7.3.22", "7.3.23", "7.3.24", "7.3.25", "7.3.26", "7.3.27", "7.3.28", "7.3.29", "7.3.30", "7.3.31", "7.4.0", "7.4.1", "7.4.2", "7.4.3", "7.4.4", "7.4.5", "7.4.6", "7.4.7", "7.4.8", "7.4.9", "7.4.10", "7.4.11", "7.4.12", "7.4.13", "7.4.14", "7.4.15", "7.4.16", "7.4.18", "7.4.19", "7.4.20", "7.4.21", "7.4.22", "7.4.23", "7.4.24", ]
# Distribution:
# > https://launchpad.net/ubuntu/xenial/amd64/php7.0-common/ (eg: 7.0.4-7ubuntu2)
# > https://launchpad.net/ubuntu/bionic/amd64/php7.1-common/
# > https://launchpad.net/ubuntu/bionic/amd64/php7.2-common/
# > https://launchpad.net/ubuntu/focal/amd64/php7.3-common/
# > https://launchpad.net/ubuntu/focal/amd64/php7.4-common/
# > https://launchpad.net/ubuntu/hirsute/amd64/php7.4-common/
# > https://launchpad.net/ubuntu/hirsute/amd64/php8.0-common/
# > https://launchpad.net/ubuntu/impish/amd64/php7.4-common/
# > https://launchpad.net/ubuntu/impish/amd64/php8.0-common/
LAUNCHPAD_PHP_VERSION = ["7.0.0-1", "7.0.0-4", "7.0.1-1", "7.0.1-2", "7.0.1-3", "7.0.1-4", "7.0.1-5", "7.0.1-6", "7.0.2-1", "7.0.2-3", "7.0.2-4", "7.0.2-5", "7.0.3-1", "7.0.3-2", "7.0.3-3", "7.0.3-4", "7.0.3-5", "7.0.3-5ubuntu1", "7.0.3-7ubuntu1", "7.0.3-9ubuntu1", "7.0.3-9ubuntu2", "7.0.4-5ubuntu1", "7.0.4-5ubuntu2", "7.0.4-7ubuntu1", "7.0.4-7ubuntu2", "7.0.4-7ubuntu2.1", "7.0.8-0ubuntu0.16.04.1", "7.0.8-0ubuntu0.16.04.2", "7.0.8-0ubuntu0.16.04.3", "7.0.13-0ubuntu0.16.04.1", "7.0.15-0ubuntu0.16.04.1", "7.0.15-0ubuntu0.16.04.2", "7.0.15-0ubuntu0.16.04.3", "7.0.15-0ubuntu0.16.04.4", "7.0.18-0ubuntu0.16.04.1", "7.0.22-0ubuntu0.16.04.1", "7.0.25-0ubuntu0.16.04.1", "7.0.28-0ubuntu0.16.04.1", "7.0.30-0ubuntu0.16.04.1", "7.0.32-0ubuntu0.16.04.1", "7.0.33-0ubuntu0.16.04.1", "7.0.33-0ubuntu0.16.04.11", "7.0.33-0ubuntu0.16.04.12", "7.0.33-0ubuntu0.16.04.14", "7.0.33-0ubuntu0.16.04.15", "7.0.33-0ubuntu0.16.04.16", "7.0.33-0ubuntu0.16.04.2", "7.0.33-0ubuntu0.16.04.3", "7.0.33-0ubuntu0.16.04.4", "7.0.33-0ubuntu0.16.04.5", "7.0.33-0ubuntu0.16.04.6", "7.0.33-0ubuntu0.16.04.7", "7.0.33-0ubuntu0.16.04.9", "7.1.8-1ubuntu1", "7.1.8-1ubuntu2", "7.1.10-0ubuntu1", "7.1.11-0ubuntu1", "7.1.11-0ubuntu2", "7.1.13-1", "7.2.1-1", "7.2.1-1ubuntu1", "7.2.1-1ubuntu2", "7.2.2-1ubuntu1", "7.2.2-1ubuntu2", "7.2.3-1ubuntu1", "7.2.5-0ubuntu0.18.04.1", "7.2.7-0ubuntu0.18.04.1", "7.2.7-0ubuntu0.18.04.2", "7.2.10-0ubuntu0.18.04.1", "7.2.15-0ubuntu0.18.04.1", "7.2.15-0ubuntu0.18.04.2", "7.2.17-0ubuntu0.18.04.1", "7.2.19-0ubuntu0.18.04.1", "7.2.19-0ubuntu0.18.04.2", "7.2.24-0ubuntu0.18.04.1", "7.2.24-0ubuntu0.18.04.2", "7.2.24-0ubuntu0.18.04.3", "7.2.24-0ubuntu0.18.04.4", "7.2.24-0ubuntu0.18.04.5", "7.2.24-0ubuntu0.18.04.6", "7.2.24-0ubuntu0.18.04.7", "7.2.24-0ubuntu0.18.04.8", "7.2.24-0ubuntu0.18.04.9", "7.3.8-1", "7.3.10-1ubuntu1", "7.3.11-0ubuntu1", "7.3.11-0ubuntu2", "7.3.12-1", "7.3.15-1", "7.3.15-2", "7.3.15-3", "7.3.15-3build1", "7.4.1-1", "7.4.2-7", "7.4.2-7build1", "7.4.3-1", "7.4.3-3", "7.4.3-4", "7.4.3-4build1", "7.4.3-4build2", "7.4.3-4ubuntu1", "7.4.3-4ubuntu1.1", "7.4.3-4ubuntu2", "7.4.3-4ubuntu2.1", "7.4.3-4ubuntu2.2", "7.4.3-4ubuntu2.3", "7.4.3-4ubuntu2.4", "7.4.3-4ubuntu2.5", "7.4.3-4ubuntu2.6", "7.4.9-1ubuntu1", "7.4.9-1ubuntu1.1", "7.4.11-1ubuntu1", "7.4.11-1ubuntu2", "7.4.11-1ubuntu3", "7.4.11-1ubuntu4", "7.4.16-1ubuntu2", "7.4.16-1ubuntu2.1", "7.4.16-1ubuntu3", "8.0.0-1", "8.0.5-1ubuntu1", "8.0.7-1", "8.0.8-1", "8.0.8-1build1"]
PHP_VERSION = PHP_VERSION + LAUNCHPAD_PHP_VERSION
def fetch_launchpad_php_versions():
launchpad_php_urls = [
"https://launchpad.net/ubuntu/xenial/amd64/php7.0-common/",
"https://launchpad.net/ubuntu/bionic/amd64/php7.1-common/",
"https://launchpad.net/ubuntu/bionic/amd64/php7.2-common/",
"https://launchpad.net/ubuntu/focal/amd64/php7.3-common/",
"https://launchpad.net/ubuntu/focal/amd64/php7.4-common/",
"https://launchpad.net/ubuntu/hirsute/amd64/php7.4-common/",
"https://launchpad.net/ubuntu/hirsute/amd64/php8.0-common/",
"https://launchpad.net/ubuntu/impish/amd64/php7.4-common/",
"https://launchpad.net/ubuntu/impish/amd64/php8.0-common/",
]
result = {}
for url in launchpad_php_urls:
result[url] = []
print("Fetching: {}".format(url))
response = requests.get(url)
soup = BeautifulSoup(response.text, 'html.parser')
table = soup.find_all(id="publishing-summary")[0]
trs = table.find_all("tr")
for tr in trs:
if "id" not in tr.attrs.keys():
links = tr.find_all("a")
if len(links) > 0:
result[url].append(links[-1].text)
print("{} versions found, eg: {}".format(len(result[url]), result[url][0]))
versions = list(set(list(itertools.chain.from_iterable(result.values()))))
versions.sort()
return versions
# Part 2
ZEND_EXTENSION_API_VERSION = 3
ZEND_EXTENSION_API_NO = []
for year in range(2015, 2023):
for month in range(1, 13):
for day in range(1, 32):
ZEND_EXTENSION_API_NO.append("{}{:4d}{:02d}{:02d}".format(ZEND_EXTENSION_API_VERSION, year, month, day))
ZEND_BUILD_TS = [",TS", ",NTS"]
# ZEND_BUILD_DEBUG = ["", ",debug"]
ZEND_BUILD_DEBUG = [""]
# ZEND_BUILD_SYSTEM = ["", "VC6", "VC7", "VC7.1", "VC8", "VC9", "VC10", "VC11", "VC12", "VC14"] + ["clang"] + ["icc"]
ZEND_BUILD_SYSTEM = [""]
ZEND_BUILD_EXTRA = [""]
ZEND_EXTENSION_BUILD_ID = []
for zean in ZEND_EXTENSION_API_NO:
for zbt in ZEND_BUILD_TS:
for zbd in ZEND_BUILD_DEBUG:
for zbs in ZEND_BUILD_SYSTEM:
for zbe in ZEND_BUILD_EXTRA:
ZEND_EXTENSION_BUILD_ID.append("API{}{}{}{}{}".format(zean, zbt, zbd, zbs, zbe))
# Part 3
ZEND_BIN_ID_BEFORE_7_4 = ["BIN_144444", "BIN_148888", "BIN_SIZEOF_CHAR44444", "BIN_SIZEOF_CHAR48888"]
ZEND_BIN_ID_SINCE_7_4 = ["BIN_44444", "BIN_48888"]
def guess(system_id):
# Brute
counter = 0
total = len(PHP_VERSION) * len(ZEND_EXTENSION_BUILD_ID) * len(ZEND_BIN_ID_BEFORE_7_4)
for pv in PHP_VERSION:
for zebi in ZEND_EXTENSION_BUILD_ID:
'''
>>> semver.compare("1.0.0", "2.0.0")
-1
>>> semver.compare("2.0.0", "1.0.0")
1
>>> semver.compare("2.0.0", "2.0.0")
0
'''
sempv = pv
if "-" in pv:
sempv = pv.split("-")[0]
if "RC" in pv:
sempv = pv.split("RC")[0]
if "alpha" in pv:
sempv = pv.split("alpha")[0]
if "beta" in pv:
sempv = pv.split("beta")[0]
if semver.compare(sempv, "7.4.0", loose=None) >= 0:
ZEND_BIN_ID = ZEND_BIN_ID_SINCE_7_4
else:
ZEND_BIN_ID = ZEND_BIN_ID_BEFORE_7_4
for zbi in ZEND_BIN_ID:
counter += 1
data = "{}{}{}".format(pv, zebi, zbi)
hash = md5(data)
if hash == system_id:
print("Found: {}".format(data))
return data
print("[{} / {} ({:.02f}%)] {} {}".format(counter, total, (counter / total) * 100, hash, data))
return None
print(guess("81d80d78c6ef96b89afaadc7ffc5d7ea")) # 7.0.4-7ubuntu2API320151012,NTSBIN_SIZEOF_CHAR48888
print(guess("7a838f426f8184a949f4dde75f3ef030")) # 7.0.8API320151012,NTSBIN_SIZEOF_CHAR48888
print(guess("0b8bd94e9858e5d32d058dc0acf75014")) # 7.0.33API320151012,NTSBIN_SIZEOF_CHAR48888
print(guess("e2c6579e4df1d9e77e36d2f4ff8c92b3")) # 7.2.24-0ubuntu0.18.04.6API320170718,NTSBIN_SIZEOF_CHAR48888
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment