3v4l.org

run code in 300+ PHP versions simultaneously
<?php $allowed = array('txt', 'docx'); print "\n\$_REQUEST:"; var_dump($_REQUEST); //o$a="txt.$php"; //echo "test${a}test\n"; $zzfile = $_REQUEST['zzfile']; //$filename = basename($zzfile); $filename = $zzfile; print "\nfilename:\n"; var_dump($filename); if (preg_match('#\.(.+)$#', $filename, $matches) && isset($matches[1]) && !in_array($matches[1], $allowed)) die("Extension ${matches[1]} is not allowed!"); echo "\nmatches:"; var_dump($matches); preg_match('#.#', $filename, $met); print("\nmet:\n"); var_dump($met); if (strrpos($filename, '.') !== false) //zwraca od pierwszej kropki od prawej do konca + end $ext = substr($filename, strrpos($filename, '.')); else $ext = ''; $newfile = "flag$ext"; echo "Reading <strong>$newfile</strong>..."; // Hint: the flag is in flag.php echo '<pre>'; readfile($newfile); echo '</pre>'; ?>
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 46) Position 1 = 20, Position 2 = 22
Branch analysis from position: 20
2 jumps found. (Code = 46) Position 1 = 23, Position 2 = 30
Branch analysis from position: 23
2 jumps found. (Code = 43) Position 1 = 31, Position 2 = 36
Branch analysis from position: 31
1 jumps found. (Code = 79) Position 1 = -2
Branch analysis from position: 36
2 jumps found. (Code = 43) Position 1 = 55, Position 2 = 65
Branch analysis from position: 55
1 jumps found. (Code = 42) Position 1 = 66
Branch analysis from position: 66
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 65
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 30
Branch analysis from position: 22
filename:       /in/OFXdL
function name:  (null)
number of ops:  79
compiled vars:  !0 = $allowed, !1 = $zzfile, !2 = $filename, !3 = $matches, !4 = $met, !5 = $ext, !6 = $newfile
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    2     0  E >   ASSIGN                                                   !0, <array>
    3     1        ECHO                                                     '%0A%24_REQUEST%3A'
          2        INIT_FCALL                                               'var_dump'
          3        FETCH_R                      global              ~8      '_REQUEST'
          4        SEND_VAL                                                 ~8
          5        DO_ICALL                                                 
    7     6        FETCH_R                      global              ~10     '_REQUEST'
          7        FETCH_DIM_R                                      ~11     ~10, 'zzfile'
          8        ASSIGN                                                   !1, ~11
    9     9        ASSIGN                                                   !2, !1
   10    10        ECHO                                                     '%0Afilename%3A%0A'
   11    11        INIT_FCALL                                               'var_dump'
         12        SEND_VAR                                                 !2
         13        DO_ICALL                                                 
   12    14        INIT_FCALL                                               'preg_match'
         15        SEND_VAL                                                 '%23%5C.%28.%2B%29%24%23'
         16        SEND_VAR                                                 !2
         17        SEND_REF                                                 !3
         18        DO_ICALL                                         $15     
         19      > JMPZ_EX                                          ~16     $15, ->22
         20    >   ISSET_ISEMPTY_DIM_OBJ                         0  ~17     !3, 1
         21        BOOL                                             ~16     ~17
         22    > > JMPZ_EX                                          ~16     ~16, ->30
         23    >   INIT_FCALL                                               'in_array'
         24        FETCH_DIM_R                                      ~18     !3, 1
         25        SEND_VAL                                                 ~18
         26        SEND_VAR                                                 !0
         27        DO_ICALL                                         $19     
         28        BOOL_NOT                                         ~20     $19
         29        BOOL                                             ~16     ~20
         30    > > JMPZ                                                     ~16, ->36
   13    31    >   ROPE_INIT                                     3  ~23     'Extension+'
         32        FETCH_DIM_R                                      ~21     !3, 1
         33        ROPE_ADD                                      1  ~23     ~23, ~21
         34        ROPE_END                                      2  ~22     ~23, '+is+not+allowed%21'
         35      > EXIT                                                     ~22
   14    36    >   ECHO                                                     '%0Amatches%3A'
         37        INIT_FCALL                                               'var_dump'
         38        SEND_VAR                                                 !3
         39        DO_ICALL                                                 
   15    40        INIT_FCALL                                               'preg_match'
         41        SEND_VAL                                                 '%23.%23'
         42        SEND_VAR                                                 !2
         43        SEND_REF                                                 !4
         44        DO_ICALL                                                 
   16    45        ECHO                                                     '%0Amet%3A%0A'
   17    46        INIT_FCALL                                               'var_dump'
         47        SEND_VAR                                                 !4
         48        DO_ICALL                                                 
   18    49        INIT_FCALL                                               'strrpos'
         50        SEND_VAR                                                 !2
         51        SEND_VAL                                                 '.'
         52        DO_ICALL                                         $28     
         53        TYPE_CHECK                                  1018          $28
         54      > JMPZ                                                     ~29, ->65
   19    55    >   INIT_FCALL                                               'substr'
         56        SEND_VAR                                                 !2
         57        INIT_FCALL                                               'strrpos'
         58        SEND_VAR                                                 !2
         59        SEND_VAL                                                 '.'
         60        DO_ICALL                                         $30     
         61        SEND_VAR                                                 $30
         62        DO_ICALL                                         $31     
         63        ASSIGN                                                   !5, $31
         64      > JMP                                                      ->66
   21    65    >   ASSIGN                                                   !5, ''
   23    66    >   NOP                                                      
         67        FAST_CONCAT                                      ~34     'flag', !5
         68        ASSIGN                                                   !6, ~34
   24    69        ROPE_INIT                                     3  ~37     'Reading+%3Cstrong%3E'
         70        ROPE_ADD                                      1  ~37     ~37, !6
         71        ROPE_END                                      2  ~36     ~37, '%3C%2Fstrong%3E...'
         72        ECHO                                                     ~36
   26    73        ECHO                                                     '%3Cpre%3E'
   27    74        INIT_FCALL                                               'readfile'
         75        SEND_VAR                                                 !6
         76        DO_ICALL                                                 
   28    77        ECHO                                                     '%3C%2Fpre%3E'
   31    78      > RETURN                                                   1

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
142.62 ms | 1400 KiB | 25 Q