UAF RCE exploit with full ASLR bypass and auto-detection

Three-stage chain: heap leak, libphp leak, zif_system terminal.
All stages succeed on first attempt against php:8.4.26-apache.

Features:
- HTTP fingerprinting auto-detects PHP version from X-Powered-By
- Built-in offset database for PHP 8.3.35, 8.4.26, 8.3.36, 8.4.27
- Inline ELF parser extracts offsets without external tools
- --auto-pull fetches matching Docker image for unknown versions
- --workers N spray mode for multi-worker Apache configs
- Docker lab setup for reproducible testing

Tested: 9/9 successful RCE runs, all stages first-attempt.

uaf-rce/docker/html/index.php

@@ -0,0 +1,3 @@
+<?php
+// Any PHP page works. session_start() is NOT required.
+echo "OK";

uaf-rce/docker/php.ini

@@ -0,0 +1,7 @@
+; Minimal config for the UAF RCE exploit lab.
+; Most settings match the stock php:8.4.26-apache defaults.
+display_errors = On
+memory_limit = 8M
+session.upload_progress.enabled = 1
+session.upload_progress.cleanup = 1
+max_input_vars = 1000