Collected research

Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine

Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine (part 3)

Turns an output-less PHP file-read into remote code execution using a one-byte glibc iconv overflow. Heap grooming through php filters overwrites a stream bucket so its buffer points anywhere, giving a crashless arbitrary read via an error oracle; the exploit then walks ELF tables to reach system and overwrites the engine's heap free handler.

Record

Document

Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine (part 3)

Published by

blog.lexfo.fr

Topic

Server

In the archive

• Collected in the 2024 research round

Related sources

• Part 1
• Proof of concept — github.com
• DEF CON 32 - Iconv, set the charset to RCE exploiting glibc to hack the PHP engine - Charles Fox

Tags

• rce
• php
• charset
• lfi
• cve
• side-channel
• attack-chain
• owasp-a01-2021
• owasp-a02-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of blog.lexfo.fr, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.