shellvector — RCE Vulnerability Scanner

Combined scanner for critical HTTP-based RCE vulnerabilities:

• CVE-2026-109618/109619 (PHP2Shell) — PHP engine upload-progress handler UAF
• CVE-2026-111497 (HTTP2Shell) — Brotli decoder out-of-bounds write

Both vulnerabilities allow unauthenticated remote code execution through HTTP request handling. This tool detects exposed versions via passive fingerprinting and optional active probes.

Note: HTTP2Shell (CVE-2026-111497) is the Brotli decoder vulnerability — not to be confused with HTTPS or HTTP/2. The name "HTTP2Shell" refers to the attack vector (HTTP request with crafted Brotli compression), not the protocol version.

Stdlib only. Python 3.8+.

---

Quick Start

# Scan a single target (passive only)
python3 shellvector.py https://target.example/

# Batch scan
python3 shellvector.py -t targets.txt -w 32 --json results.json

# Enhanced scanning with error page and path probing
python3 shellvector.py https://target.example/ --error-probe --probe-paths

# Active probes (opt-in, may trigger alerts)
python3 shellvector.py https://target.example/ --php-canary --brotli-probe

# Full scan with external tools (WhatWeb/Nmap) and passive DNS
python3 shellvector.py https://target.example/ --external-scan --passive-dns

# Show all results including non-vulnerable
python3 shellvector.py -t targets.txt --all --verbose

---

Vulnerabilities Detected

PHP2Shell (CVE-2026-109618/109619)

Vector: Heap UAF in PHP upload-progress handler → zend_call_function → system()

Affected: PHP 5.4–8.5 (all EOL branches vulnerable)

Fixed:

Branch	Fixed Version
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35
8.1 and older	— (EOL, all vulnerable)

CVSS: 9.2 (Critical)

HTTP2Shell (CVE-2026-111497)

Vector: Out-of-bounds write in Brotli decoder via crafted compressed stream

Affected:

• Brotli lib: 1.0.3–1.2.0
• Node.js: 22.x, 24.x, 26.x (before patched releases)
• Bun: < 1.4.4
• Envoy: < 1.40.0 (varies by branch)
• Istio: < 1.29.9, 1.30.6, 1.31.2

Fixed:

Runtime	Fixed Version
Brotli 1.0.x	1.0.10
Brotli 1.1.x	1.1.1
Brotli 1.2.x	1.2.1
Node.js 22.x	22.23.4
Node.js 24.x	24.22.1
Node.js 26.x	26.12.1
Bun	1.4.4

CVSS: 9.2 (Critical)

---

Detection Modes

Mode	Description	Risk
fingerprint (default)	Passive version detection via HTTP headers	Safe
--error-probe	Trigger 404/500 errors to extract version from stack traces	Low
--probe-paths	Scan common paths (/phpinfo.php, /info.php, etc.)	Low
--external-scan	Run WhatWeb/Nmap if available	Low
--passive-dns	Lookup passive DNS data (Shodan/Censys)	Safe
--php-canary	Small multipart POST with PHP_SESSION_UPLOAD_PROGRESS	Low
--brotli-probe	Send minimal Brotli stream to test decoder	Medium

---

Output Format

The scanner displays a clean, professional output with an ASCII banner, detailed results per target, and a summary table.

Example Output

  _________.__           .__  .______   ____             __                
 /   _____/|  |__   ____ |  | |  \   \ /   /____   _____/  |_  ___________ 
 \_____  \ |  |  \_/ __ \|  | |  |\   Y   // __ \_/ ___\   __\/  _ \_  __ \
 /        \|   Y  \  ___/|  |_|  |_\     /\  ___/\  \___|  | (  <_> )  | \/
/_______  /|___|  /\___  >____/____/\___/  \___  >\___  >__|  \____/|__|   
        \/      \/     \/                      \/     \/                   

  shellvector v2.1 — RCE Vulnerability Scanner
  PHP2Shell (CVE-2026-109618/109619) | HTTP2Shell (CVE-2026-111497)
  2026-10-26 12:17:18
  ============================================================

  [  LOW  ]  php2shell.uk
  --------------------------------------------------
    * Brotli support: Yes

======================================================================
  SCAN SUMMARY
======================================================================
  Target                    PHP2Shell       HTTP2Shell      Risk      
  -----------------------------------------------------------------
  php2shell.uk              -               -               LOW       

----------------------------------------------------------------------
  OVERALL STATISTICS
----------------------------------------------------------------------
  [+] Total targets scanned:     1
  [-] PHP2Shell vulnerable:      0
  [-] HTTP2Shell vulnerable:     0
  [!] Critical risk:             0
  [!] High risk:                 0
  [*] Medium risk:               0
  [+] Low risk:                  1

======================================================================
  Scan completed at 2026-10-26 12:17:18
======================================================================

---

Risk Levels

Score	Level
7.0+	CRITICAL
5.0–6.9	HIGH
3.0–4.9	MEDIUM
< 3.0	LOW

---

References

PHP2Shell

• Datadog Security Labs: https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/
• Sansec: https://sansec.io/research/php2shell
• Qualys: https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities

HTTP2Shell

• Upwind Security: https://www.upwind.io/feed/http2shell-cve-2026-111497-one-brotli-bug-rce-across-the-http-stack
• JFrog Security: https://research.jfrog.com/post/brotli2shell-beyond-node2shell-and-http2shell/
• SecurityWeek: https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/

---

Notes

• Passive fingerprinting only sees versions the runtime chooses to expose
• CDNs (Cloudflare, Fastly) may hide origin server versions
• Enhanced probing (--error-probe, --probe-paths) can uncover hidden versions
• External tools (WhatWeb, Nmap) provide additional fingerprinting when available
• Passive DNS (Shodan/Censys) shows historical version data (API keys required)
• Active probes (--php-canary, --brotli-probe) may trigger alerts or crash vulnerable servers
• Vendor backports may fix vulnerabilities without changing version numbers

Requirements

• Python 3.8+ (stdlib only)
• Optional: whatweb, nmap (for --external-scan)
• Optional: Shodan/Censys API keys (for enhanced --passive-dns)

---

License

MIT — for authorized security testing only. Use responsibly.