隨著雲端運算與服務導向架構的普及，PHP 長期穩居伺服器端程式語言的主流地位，其安全性牽動整體網路環境之風險控管。為將漏洞發掘到產出漏洞利用輸入（exploit）的流程自動化，自動化漏洞利用生成（Automatic Exploit Generation， AEG）技術應運而生。然而，既有以原始碼為基礎的靜態分析與靜態 AEG，在程式未實際執行下難以排除不可行路徑（infeasible path），增加分析成本並可能導致誤報。且因無法掌握 PHP 可變變數、動態分派與動態檔案引入等須於執行期方能確定之動態特性，而易產生漏報。為此，本研究提出一套以執行期真實執行軌跡為核心的動態 AEG 系統。系統透過 PHP Extension 於 Zend VM 之 opcode 層級攔截每條指令，取得執行期之運算元值、變數名稱與跳轉資訊。分析器再將多次請求累積之軌跡增量融合為控制流程圖（Control Flow Graph， CFG），並於其上執行污點分析與約束求解，針對跨站腳本（XSS）、SQL 注入（SQLi）、命令注入（CMDi）與伺服器端請求偽造（SSRF）漏洞產生對應之漏洞利用輸入（exploit）。實驗結果顯示，於動態特性處理上，相較於 opcode 層級對動態特性處理最完整之靜態工具 Yama，本系統能正確解析目標僅於執行期可知之動態構造，涵蓋 Yama 漏報或過度近似而誤報之案例。分析成本上，於偵測結果一致之專案，本系統之分析階段耗時較 Navex-fixed 為短，以此驗證本系統分析成本方面之可行性。真實場景上，本系統於靶機程式及真實開源專案完成由偵測至 exploit 生成之完整流程，驗證其於真實環境之有效性。;As cloud computing and service-oriented architecture proliferate， PHP remains the dominant server-side language， and its security is central to the risk management of the entire web environment. Automatic Exploit Generation (AEG) automates the path from vulnerability discovery to a usable exploit. However， existing source-code-based static analysis and static AEG run without executing the program: they have difficulty excluding infeasible paths， which raises cost and causes false positives， and cannot resolve PHP dynamic features such as variable variables， dynamic dispatch， and dynamic file inclusion， whose targets are fixed only at runtime， causing false negatives. This study proposes a dynamic AEG system centered on real runtime traces. A PHP Extension hooks each instruction at the Zend VM opcode level to capture runtime operand values， variable names， and jump information; the analyzer incrementally fuses traces across requests into a Control Flow Graph (CFG)， on which taint analysis and constraint solving generate exploits for XSS， SQLi， CMDi， and SSRF. The experimental results demonstrate three main findings. For dynamic features， compared with Yama—the static tool with the most complete opcode-level handling of such features—our system correctly resolves constructs whose targets are known only at runtime， covering cases Yama misses or over-approximates， leading to false positives. For analysis cost， on projects with identical detection results， our system′s analysis stage takes less time than Navex-fixed， demonstrating its feasibility in terms of cost. In real-world scenarios， our system completes the full pipeline from detection to exploit generation on vulnerable web applications and real open-source projects， validating its effectiveness in practical environments.
