Come on, ASLR off? memory limit 8 MB? 8.5.11 build? and NOT stock image.
Do you actually understand what you have?
It's like saying you have instructions on how to get into someone's house, but first you need the key, the alarm needs to be disabled, you need to do it between 1:05-1:10 am, and the guards need to be lured away from the property or your instructions will not work.
I'm amazed that you didn't write "come on, not with muslc???"
Read up on what ASLR does, then read the heap feng shui document (or at least towards the fourth headline in the README), then come back here. Because it does not work the way you think it does.
I even let the agent create two separate demos for this, one for ASLR and one without, but people are still to stupid to understand it.
Versions are pinned, replace it, check the fatal.php to get the initial memory distances, then retry it again. It'll work, that is the freakin point of the demo.