2 Commits

Include renames

Author	SHA1	Message	Date
neko	e02c9f3122	Bypass post_max_size via chunked Transfer-Encoding for stock PHP RCE ... PHP checks Content-Length against post_max_size before parsing multipart bodies, but Transfer-Encoding: chunked requests have no Content-Length. The full chunked body is processed without any size check, allowing the exploit to send 140MB+ to exhaust memory_limit=128M despite post_max_size=8M. This removes the last non-default configuration requirement. The exploit now achieves full RCE against stock php:*-apache Docker images with zero configuration changes (4/4 confirmed on php:8.4.26-apache). Changes: - post() auto-switches to chunked TE for bodies over 8MB - Default --huge-mb raised from 12 to 140 (exceeds stock 128M limit) - README rewritten to document the working three-stage RCE chain - docker-compose.yml adds stock variant for testing	2026-10-22 12:58:04 +00:00
neko	13fdd2b446	UAF RCE exploit with full ASLR bypass and auto-detection ... Three-stage chain: heap leak, libphp leak, zif_system terminal. All stages succeed on first attempt against php:8.4.26-apache. Features: - HTTP fingerprinting auto-detects PHP version from X-Powered-By - Built-in offset database for PHP 8.3.35, 8.4.26, 8.3.36, 8.4.27 - Inline ELF parser extracts offsets without external tools - --auto-pull fetches matching Docker image for unknown versions - --workers N spray mode for multi-worker Apache configs - Docker lab setup for reproducible testing Tested: 9/9 successful RCE runs, all stages first-attempt.	2026-10-22 12:39:30 +00:00