Strip repo to UAF RCE exploit only

Removed all exploits that require LFI or FPM access:
- cve-2026-109618/ (OOM + LFI)
- cve-2026-109619/ (session poisoning + LFI)
- session-deser/ (handler mismatch + deserialization chains)
- bypass/ (patch bypasses, all LFI-dependent)
- nolfi/ (served save_path + FPM pathinfo)
- fcgi/ (FastCGI auto_prepend_file)
- wordpress-exploit/ (LFI wrapper)
- wordpress/ (vulnerable plugin)

Moved the UAF RCE exploit (full ASLR bypass, no LFI, no FPM, no
framework) to the repository root. Rewrote README with exploit
details, usage, patch analysis, and test results. Cleaned .gitignore.

This commit is contained in:

neko

2026-10-23 12:24:55 +00:00

parent 32e5d9c8fa

commit 9945223910

38 changed files with 252 additions and 7287 deletions

									
										docker/php-deoff.ini
									
		+5
		
												View File
												
				@@ -0,0 +1,5 @@

				display_errors = Off

				memory_limit = 128M

				session.upload_progress.enabled = 1

				session.upload_progress.cleanup = 1

				max_input_vars = 1000