neko
13fdd2b446
Three-stage chain: heap leak, libphp leak, zif_system terminal. All stages succeed on first attempt against php:8.4.26-apache. Features: - HTTP fingerprinting auto-detects PHP version from X-Powered-By - Built-in offset database for PHP 8.3.35, 8.4.26, 8.3.36, 8.4.27 - Inline ELF parser extracts offsets without external tools - --auto-pull fetches matching Docker image for unknown versions - --workers N spray mode for multi-worker Apache configs - Docker lab setup for reproducible testing Tested: 9/9 successful RCE runs, all stages first-attempt.
4 lines
73 B
PHP
4 lines
73 B
PHP
<?php
|
|
// Any PHP page works. session_start() is NOT required.
|
|
echo "OK";
|