>and handing over a functional exploit

There are dozens (or hundreds) of functional exploits already. The problem with php2shell exploits is that (as of now) there's no "one exploit pwns all", and researchers need to spend nontrivial amount of time on every (potentially) exploitable target.

So I don't think I agree - it's a fun challenge for the itsec people around here, and some people will definitely try. There's no real opportunity cost here. The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.

> there's no "one exploit pwns all"

I think what he's saying is if you had that, you certainly wouldn't use it on a known honeypot for 500 bucks.

> The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.

Exactly. This server is exploitable, but not with an off-the-shelf PHP2Shell PoC someone found on GitHub. The PHP2Shell exploit would need adjustment to the specific application configuration, and to that end, you’ve come to the same conclusion I was implying.

The easiest way is to use PHP2Shell _with_ another unknown vulnerability in the stack, such as nginx etc…

The challenge is trivial to those who know better than to even try. You cannot succeed at it without giving away far more than you could ever possibly hope to gain.

Of course, there’s always the wildcard of someone throwing away the nginx 0-day just to be funny.

Correct me if I'm wrong but isn't every PHP RCE... 2 shell?