Code Execution Vulnerability - no alphanumeric rce create_ function()

Code Execution Vulnerability

eval() function

<?php eval($_POST[0]);?>

eval The received string will be treated as PHP Code to execute （ In a word, Trojans ）

Use this to connect the ant sword , The connection password is the value in brackets –$_POST[0] This is it in ‘0’ As the connection password

No alphanumeric RCE

Harsh RCE

Take the opposite 、 Exclusive or How to get around

Take the following example ：

Exclusive or method ：
XOR.php

Execution is terminal php XOR.php
utilize PHP7 Characteristics of — Dynamic function execution calls ：

If it is system(ls)— Once it was system Once it was ls
Empathy ：

The reverse method ：
qufan.php


hackbar in ：

create_function()

create_function() Function has two arguments $argsand$code, Used to create a lambda Function of style

create_function() It has been gradually eliminated

PS

Filter length , Brackets ... When there are so many things , You can try ：

?> Achieve closure

<? yes PHP The short tag of <?= Express <? echo for example  It means output abc And then look at ： `` A pair of backquotes is shell_exec Execute system commands %20 amount to Space The system command executed is equivalent to ： **/???/??? *** In fact, that is /bin/cat One star behind and * Namely flag.php