php2shell/push-to-github.sh at main · hoed/php2shell · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
#!/usr/bin/env bash
# PHP2Shell Sentinel — GitHub repo setup & push
# Run this ONCE from inside /home/hoed/php2shell after: gh auth login
#
# Usage:
#   cd /home/hoed/php2shell
#   gh auth login          # follow prompts (browser or token)
#   bash push-to-github.sh [your-github-username]

set -euo pipefail

REPO_NAME="php2shell-sentinel"
DESCRIPTION="PHP Runtime Vulnerability Assessment Toolkit — CVE-2026-109618 & CVE-2026-109619"
USERNAME="${1:-}"

# ── Validate ──────────────────────────────────────────────────────────────────
if ! command -v gh &>/dev/null; then
    echo "ERROR: GitHub CLI (gh) not found. Install with: apt-get install gh"
    exit 1
fi

if ! gh auth status &>/dev/null; then
    echo "ERROR: Not logged into GitHub. Run: gh auth login"
    exit 1
fi

if [[ -z "$USERNAME" ]]; then
    USERNAME=$(gh api user --jq '.login')
    echo "Using GitHub username: $USERNAME"
fi

# ── Create repo ───────────────────────────────────────────────────────────────
echo ""
echo "Creating GitHub repository: $USERNAME/$REPO_NAME ..."

gh repo create "$REPO_NAME" \
    --public \
    --description "$DESCRIPTION" \
    --homepage "https://github.com/$USERNAME/$REPO_NAME" \
    2>&1 || {
        echo "Repository may already exist — continuing with push..."
    }

# ── Set remote & push ─────────────────────────────────────────────────────────
REMOTE_URL="https://github.com/$USERNAME/$REPO_NAME.git"

if git remote get-url origin &>/dev/null; then
    git remote set-url origin "$REMOTE_URL"
else
    git remote add origin "$REMOTE_URL"
fi

echo ""
echo "Pushing to $REMOTE_URL ..."
git push -u origin main

# ── Add topics / labels ───────────────────────────────────────────────────────
echo ""
echo "Adding repository topics..."
gh repo edit "$USERNAME/$REPO_NAME" \
    --add-topic security \
    --add-topic php \
    --add-topic vulnerability-assessment \
    --add-topic cve \
    --add-topic kali-linux \
    --add-topic defensive-security \
    2>/dev/null || true

# ── Create initial GitHub release ─────────────────────────────────────────────
echo ""
echo "Creating v1.0.0 release..."
gh release create v1.0.0 \
    --repo "$USERNAME/$REPO_NAME" \
    --title "v1.0.0 — Initial Release" \
    --notes "## PHP2Shell Sentinel v1.0.0

Assessment toolkit for **CVE-2026-109618** and **CVE-2026-109619** (PHP2Shell).

### What's included
- Local PHP binary, php.ini, and PHP-FPM audit
- Remote HTTP header assessment with scope allowlist
- Deep passive fingerprinting (headers, error pages, cookies, timing)
- Patch matrix for PHP 8.2–8.5; EOL detection for 8.1 and older
- Terminal (Rich), JSON, and Markdown reports
- Isolated Docker lab (localhost-only)
- 71 unit + integration tests

### CVE References
- [CVE-2026-109618](https://github.com/advisories/GHSA-w8hw-w9fx-j79w)
- [CVE-2026-109619](https://github.com/advisories/GHSA-6wmf-4rv5-p3rp)

### Install
\`\`\`bash
git clone https://github.com/$USERNAME/$REPO_NAME.git
cd $REPO_NAME
python3 -m venv .venv && source .venv/bin/activate
pip install -e .
php2shell-sentinel --help
\`\`\`" \
    2>/dev/null || echo "Release may already exist — skipping."

# ── Summary ───────────────────────────────────────────────────────────────────
echo ""
echo "=========================================="
echo " Done!"
echo " Repository: https://github.com/$USERNAME/$REPO_NAME"
echo " Actions:    https://github.com/$USERNAME/$REPO_NAME/actions"
echo " Releases:   https://github.com/$USERNAME/$REPO_NAME/releases"
echo "=========================================="