3v4l.org

run code in 300+ PHP versions simultaneously
<?php // ultimate goal...inject command into $upacked that will read a text file in the same dir as php file $post_seeds = "1154731896 "; $hard_coded_algo = "5368413128644154652843527950542843524333322873545252655628414273282431255371725428655850284558702870492829292929292929292929"; $uPacked = unpack("H*", "ShA1(dATe('')) "); $test = $uPacked[1]; //abcdefghi pqrstuvwxy // allowed chars echo pack("H*", $test); echo "<br />"; echo pack("H*", $hard_coded_algo); echo "<br />"; if(comp($hard_coded_algo, $test)){ // ShA1(dATe(CRyPT(CRC32(sTRReV(ABs($1%SqrT(eXP(EXp(pI()))))))))) // magical execution printf(preg_replace("#\b(\d+)\b#se", pack("H*", $test), $post_seeds)); } else { echo "<br /> Hacker Detected "; } echo "<br />"; echo sha1(date('')); function comp($numOne, $numTwo){ // Show that php doesn't correctly compare numeric strings echo "<br />"; echo "<br />"; echo "Comparing the numbers"; echo "<br />"; echo $numOne; echo "<br />"; echo $numTwo; echo "<br />"; echo floatval($numOne); echo "<br />"; echo floatval($numTwo); echo "<br />"; if($numOne != $numTwo){ echo "Not Matching <br />"; return false; } else { echo "Matching </br>"; return true; } } ?>
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 26, Position 2 = 39
Branch analysis from position: 26
1 jumps found. (Code = 42) Position 1 = 40
Branch analysis from position: 40
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 39
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/16in5
function name:  (null)
number of ops:  49
compiled vars:  !0 = $post_seeds, !1 = $hard_coded_algo, !2 = $uPacked, !3 = $test
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    6     0  E >   ASSIGN                                                   !0, '1154731896+'
    7     1        ASSIGN                                                   !1, '5368413128644154652843527950542843524333322873545252655628414273282431255371725428655850284558702870492829292929292929292929'
    9     2        INIT_FCALL                                               'unpack'
          3        SEND_VAL                                                 'H%2A'
          4        SEND_VAL                                                 'ShA1%28dATe%28%27%27%29%29++++++++++++++++++++++++++++++++++++++++++++++++'
          5        DO_ICALL                                         $6      
          6        ASSIGN                                                   !2, $6
   10     7        FETCH_DIM_R                                      ~8      !2, 1
          8        ASSIGN                                                   !3, ~8
   14     9        INIT_FCALL                                               'pack'
         10        SEND_VAL                                                 'H%2A'
         11        SEND_VAR                                                 !3
         12        DO_ICALL                                         $10     
         13        ECHO                                                     $10
   15    14        ECHO                                                     '%3Cbr+%2F%3E'
   16    15        INIT_FCALL                                               'pack'
         16        SEND_VAL                                                 'H%2A'
         17        SEND_VAR                                                 !1
         18        DO_ICALL                                         $11     
         19        ECHO                                                     $11
   17    20        ECHO                                                     '%3Cbr+%2F%3E'
   19    21        INIT_FCALL_BY_NAME                                       'comp'
         22        SEND_VAR_EX                                              !1
         23        SEND_VAR_EX                                              !3
         24        DO_FCALL                                      0  $12     
         25      > JMPZ                                                     $12, ->39
   22    26    >   INIT_FCALL                                               'printf'
         27        INIT_FCALL                                               'preg_replace'
         28        SEND_VAL                                                 '%23%5Cb%28%5Cd%2B%29%5Cb%23se'
         29        INIT_FCALL                                               'pack'
         30        SEND_VAL                                                 'H%2A'
         31        SEND_VAR                                                 !3
         32        DO_ICALL                                         $13     
         33        SEND_VAR                                                 $13
         34        SEND_VAR                                                 !0
         35        DO_ICALL                                         $14     
         36        SEND_VAR                                                 $14
         37        DO_ICALL                                                 
         38      > JMP                                                      ->40
   24    39    >   ECHO                                                     '%3Cbr+%2F%3E+Hacker+Detected+'
   27    40    >   ECHO                                                     '%3Cbr+%2F%3E'
   28    41        INIT_FCALL                                               'sha1'
         42        INIT_FCALL                                               'date'
         43        SEND_VAL                                                 ''
         44        DO_ICALL                                         $16     
         45        SEND_VAR                                                 $16
         46        DO_ICALL                                         $17     
         47        ECHO                                                     $17
   53    48      > RETURN                                                   1

Function comp:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 18, Position 2 = 21
Branch analysis from position: 18
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 21
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/16in5
function name:  comp
number of ops:  24
compiled vars:  !0 = $numOne, !1 = $numTwo
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   30     0  E >   RECV                                             !0      
          1        RECV                                             !1      
   32     2        ECHO                                                     '%3Cbr+%2F%3E'
   33     3        ECHO                                                     '%3Cbr+%2F%3E'
   34     4        ECHO                                                     'Comparing+the+numbers'
   35     5        ECHO                                                     '%3Cbr+%2F%3E'
   36     6        ECHO                                                     !0
   37     7        ECHO                                                     '%3Cbr+%2F%3E'
   38     8        ECHO                                                     !1
   39     9        ECHO                                                     '%3Cbr+%2F%3E'
   40    10        CAST                                          5  ~2      !0
         11        ECHO                                                     ~2
   41    12        ECHO                                                     '%3Cbr+%2F%3E'
   42    13        CAST                                          5  ~3      !1
         14        ECHO                                                     ~3
   43    15        ECHO                                                     '%3Cbr+%2F%3E'
   45    16        IS_NOT_EQUAL                                             !0, !1
         17      > JMPZ                                                     ~4, ->21
   46    18    >   ECHO                                                     'Not+Matching+%3Cbr+%2F%3E'
   47    19      > RETURN                                                   <false>
         20*       JMP                                                      ->23
   49    21    >   ECHO                                                     'Matching+%3C%2Fbr%3E'
   50    22      > RETURN                                                   <true>
   52    23*     > RETURN                                                   null

End of function comp

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
158.78 ms | 1400 KiB | 25 Q