2 Commits

Include renames

Author	SHA1	Message	Date
neko	1d0e9f67fe	Fix PHP 8.3.35 HTDATA_OFFSET and document display_errors constraint ... - Correct HTDATA_OFFSET for PHP 8.3.35/bookworm from 0x690D8 to 0x700D8 (different struct sizes shift the heap layout by 7 pages) - Verified RCE: 8.4.26 and 8.3.35 both succeed on first attempt - Document the display_errors=On requirement for the info leak stages - Explain why stock PHP and stock WordPress-on-PHP are still vulnerable (display_errors defaults to On; WordPress ini_set runs after parsing) - Add docker configs for display_errors=Off test containers	2026-10-22 19:11:28 +00:00
neko	13fdd2b446	UAF RCE exploit with full ASLR bypass and auto-detection ... Three-stage chain: heap leak, libphp leak, zif_system terminal. All stages succeed on first attempt against php:8.4.26-apache. Features: - HTTP fingerprinting auto-detects PHP version from X-Powered-By - Built-in offset database for PHP 8.3.35, 8.4.26, 8.3.36, 8.4.27 - Inline ELF parser extracts offsets without external tools - --auto-pull fetches matching Docker image for unknown versions - --workers N spray mode for multi-worker Apache configs - Docker lab setup for reproducible testing Tested: 9/9 successful RCE runs, all stages first-attempt.	2026-10-22 12:39:30 +00:00