neko
9945223910
Removed all exploits that require LFI or FPM access: - cve-2026-109618/ (OOM + LFI) - cve-2026-109619/ (session poisoning + LFI) - session-deser/ (handler mismatch + deserialization chains) - bypass/ (patch bypasses, all LFI-dependent) - nolfi/ (served save_path + FPM pathinfo) - fcgi/ (FastCGI auto_prepend_file) - wordpress-exploit/ (LFI wrapper) - wordpress/ (vulnerable plugin) Moved the UAF RCE exploit (full ASLR bypass, no LFI, no FPM, no framework) to the repository root. Rewrote README with exploit details, usage, patch analysis, and test results. Cleaned .gitignore.
22 lines
597 B
YAML
22 lines
597 B
YAML
services:
|
|
target:
|
|
image: php:8.4.26-apache
|
|
container_name: php2shell-uaf-target
|
|
ports:
|
|
- "127.0.0.1:8089:80"
|
|
volumes:
|
|
- ./php.ini:/usr/local/etc/php/php.ini:ro
|
|
- ./apache-prefork.conf:/etc/apache2/mods-available/mpm_prefork.conf:ro
|
|
- ./html:/var/www/html:rw
|
|
restart: unless-stopped
|
|
|
|
stock:
|
|
image: php:8.4.26-apache
|
|
container_name: php2shell-uaf-stock
|
|
ports:
|
|
- "127.0.0.1:8093:80"
|
|
volumes:
|
|
- ./apache-prefork.conf:/etc/apache2/mods-available/mpm_prefork.conf:ro
|
|
- ./html:/var/www/html:ro
|
|
restart: unless-stopped
|