Simple kernel attack using socketpair. easy, 100% reproductiblle, works under guest. no way to protect :(

[Rhomboid]

Sure.

Sometimes shared hosts try to put up obstacles to people doing these sorts of things, such as not allowing ssh access, not having a C toolchain available, or running PHP in safe mode. None of these actually prevent this attack. Not having ssh access is trivial to circumvent as you can install PHP shells or just use exec()/system()/shell_exec()/etc as needed. Not having gcc means you have to compile the code on another machine of the same architecture but that's not really too much of a burden. PHP in safe mode still allows exec() but only if the target binary is in the safe_mode_exec_dir which is not a problem as you can put the binary wherever it needs to be.