UAF RCE exploit with full ASLR bypass and auto-detection

Browse Source

Three-stage chain: heap leak, libphp leak, zif_system terminal.
All stages succeed on first attempt against php:8.4.26-apache.

Features:
- HTTP fingerprinting auto-detects PHP version from X-Powered-By
- Built-in offset database for PHP 8.3.35, 8.4.26, 8.3.36, 8.4.27
- Inline ELF parser extracts offsets without external tools
- --auto-pull fetches matching Docker image for unknown versions
- --workers N spray mode for multi-worker Apache configs
- Docker lab setup for reproducible testing

Tested: 9/9 successful RCE runs, all stages first-attempt.

...

This commit is contained in:

neko

2026-10-22 12:39:30 +00:00

parent 39f7f33938

commit 13fdd2b446

3 changed files with 1040 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

uaf-rce/rce_exploit.py

+1030

File diff suppressed because it is too large Load Diff