Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Sounds like you didn't prove its vulnerable against a stock PHP server though, so that's not a great response.
 help



> Sounds like you didn't prove its vulnerable against a stock PHP server though, so that's not a great response.

No I proved exactly that. Learn to read.


Come on, ASLR off? memory limit 8 MB? 8.5.11 build? and NOT stock image.

Do you actually understand what you have?

It's like saying you have instructions on how to get into someone's house, but first you need the key, the alarm needs to be disabled, you need to do it between 1:05-1:10 am, and the guards need to be lured away from the property or your instructions will not work.


I'm amazed that you didn't write "come on, not with muslc???"

Read up on what ASLR does, then read the heap feng shui document (or at least towards the fourth headline in the README), then come back here. Because it does not work the way you think it does.

I even let the agent create two separate demos for this, one for ASLR and one without, but people are still to stupid to understand it.

Versions are pinned, replace it, check the fatal.php to get the initial memory distances, then retry it again. It'll work, that is the freakin point of the demo.




Consider applying for YC's Winter 2027 batch! Applications are open till November 2.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: