Unauthenticated command injection in Xdebug remote debugging interface

Repository contains a small standalone Python exploit PoC for CVE-2015-10141 and a README describing the vulnerability. The main file, exploit.py, implements an attacker-side Xdebug DBGp listener and an HTTP trigger mechanism. It base64-encodes attacker-supplied PHP into an 'eval -i 1 -- <base64>\x00' DBGp command, waits for the vulnerable target to connect back to the listener, sends the eval request, and parses CDATA/base64-wrapped results from the Xdebug response. The exploit supports two primary modes: direct arbitrary PHP/command execution and reverse-shell delivery. In reverse-shell mode it starts a listener on attacker-specified LHOST/LPORT, generates multiple PHP reverse-shell payload attempts, and iterates through them until a shell is established. The code also supports optional spoofing-related headers (X-Forwarded-For and Client-IP) when triggering the target URL. Overall, this is a real operational PoC for unauthenticated remote code execution against vulnerable Xdebug deployments exposed through a reachable web application and remote debugging callback path.

This repository contains a proof-of-concept exploit for CVE-2015-10141, a remote code execution vulnerability in Xdebug versions 2.5.5 and earlier. The main exploit file, 'exploit.py', is a Python script that establishes a listener on TCP port 9000 and initiates a debugging session with the target Xdebug instance. By leveraging the unauthenticated Xdebug debugging protocol, the script allows the attacker to send base64-encoded PHP system() commands, effectively providing an interactive shell for arbitrary command execution on the target server. The exploit requires the target to have Xdebug remote debugging enabled and accessible. The repository is structured with a single exploit script, a README with usage instructions and vulnerability details, and a license file. No detection scripts or fake code are present; the exploit is functional and demonstrates the vulnerability as described.

This repository contains a Python exploit script (CVE-2015-10141.py) targeting CVE-2015-10141, a remote code execution vulnerability in Xdebug (<=2.5.5), a PHP debugging extension. The exploit works by abusing the unauthenticated debugger protocol on port 9000, which allows arbitrary PHP code execution when remote debugging is enabled. The script takes a target URL and a local host IP as arguments. It triggers the vulnerability by sending a specially crafted HTTP request to the target, causing the target's Xdebug instance to connect back to the attacker's machine on port 9000. The script then provides an interactive shell-like interface, allowing the attacker to send system commands to the target and receive their output. The repository includes a README with usage instructions, references, and a requirements.txt listing Python dependencies. The main exploit file is self-contained and does not rely on any external exploit frameworks. The attack vector is network-based, requiring the attacker to be able to reach the target's web server and receive incoming connections on port 9000. The exploit is operational and provides a working remote shell if the target is vulnerable.

This repository contains a single Metasploit module (modules/exploits/unix/http/xdebug_unauth_exec.rb) that exploits an unauthenticated OS command execution vulnerability in Xdebug (CVE-2015-10141), affecting versions 2.5.5 and below. The exploit works by sending a specially crafted HTTP request to a web application with Xdebug enabled, then interacting with the Xdebug debugger port (default 9000) to execute arbitrary PHP code. The module is highly weaponized, supporting customizable payloads (defaulting to php/meterpreter/reverse_tcp) and providing a reverse shell or Meterpreter session upon successful exploitation. The code is written in Ruby and is designed to be used within the Metasploit framework. The only file present is the exploit module itself, which includes all necessary logic for detection, exploitation, and payload delivery. Key fingerprintable endpoints include the web application path (default /index.php) and the Xdebug debugger port (default 9000/tcp).